Log in Start free

Vulnerability · Published May 27, 2026 · Assigned by VulDB

CVE-2026-4390TeamSpeak 3 Server Connection State Management process_resend_queue use after free

Medium 5.4

In plain English

A medium-severity use-after-free in TeamSpeak 3 Server. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.3%top 82.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

A weakness has been identified in TeamSpeak 3 Server up to 3.13.7. This affects the function process_resend_queue of the component Connection State Management. This manipulation causes use after free. The attack may be initiated remotely. Upgrading to version 3.13.8 is able to mitigate this issue. The affected component should be upgraded.

Affected products (as reported)

VendorProductVersions
n/a TeamSpeak 3 Server 3.13.03.13.13.13.23.13.33.13.43.13.53.13.63.13.7

Weakness: CWE-416, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C

References