PT-2026-5250 · Teamviewer · Teamviewer Dex - 1E Client

Published 2026-01-29 · Updated 2026-02-11 · CVE-2026-23563

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions TeamViewer DEX - 1E Client versions prior to 26.1

Description The software contains a flaw related to improper link resolution before file access. This issue, triggered by the 1E‑Explorer‑TachyonCore‑DeleteFileByPath instruction, allows a local attacker with limited privileges to delete protected system files. This is achieved by utilizing a specially crafted Remote Procedure Call (RPC) control junction or symbolic link that is followed during the execution of the delete instruction.

Recommendations Versions prior to 26.1 should be updated to version 26.1 or later.

Fix

LPE

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2026-23563

Affected Products

Teamviewer Dex - 1E Client

References · 8

• https://teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1002 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23563 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23563 · Vendor Advisory
• https://t.me/cveNotify/150242 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2016827129007087749 · Twitter Post
• https://t.me/CVEtracker/43219 · Telegram Post
• https://twitter.com/CVEnew/status/2016805046437237201 · Twitter Post
• https://t.me/cveNotify/151749 · Telegram Post