TeamViewer DEX CVE-2025-64995

Requires pre-existing local access to a Windows device running TeamViewer DEX / 1E DEX at a version prior to V3.4, plus the ability to write to the execution path used by the 1E-Exchange-NomadClientHealth-ConfigureGeneralSetting instruction, and the attacker must act while that instruction executes (local access 'during execution'). Exploitation is limited by: no remote vector (AV:L, physical/local presence or prior code execution required), dependence on the vulnerable NomadClientHealth instruction being present and running, and the vendor-stated need for existing privileges (PR:H). Upgrading to V3.4 or later removes the condition.

This is a genuine but conditional local privilege-escalation issue, not a top-tier emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 6.7) confirms the attacker must already have local access and - per the vendor - high existing privileges, which caps real-world risk. EPSS is very low (0.17%, 5th percentile) and the CVE is NOT in CISA KEV, with no public exploit identified at time of analysis, so there is no signal of active or imminent widespread exploitation. The signals are therefore consistent rather than conflicting: low EPSS, no KEV, no POC, and a local-only vector all point to a 'fix on normal patch cadence' item rather than an incident. One point to verify with the vendor: the vector lists PR:H, yet the vulnerability class (CWE-427 uncontrolled search path yielding SYSTEM) is typically exploited by a LOW-privileged user escalating to SYSTEM - if a standard user can write to the hijacked execution path, the true privilege requirement is lower and impact higher than the 6.7 suggests.

A local user (or malware already running at user level) on a Windows endpoint running TeamViewer DEX / 1E DEX plants a malicious binary or DLL in the unprotected execution path used by the 1E-Exchange-NomadClientHealth-ConfigureGeneralSetting instruction. When that instruction next executes under the DEX agent, it loads the attacker's payload and runs it with SYSTEM privileges, giving full control of the host. No public exploit code has been identified at time of analysis.