TeamSpeak 3 Server Use-After-Free in Connection State Management (process_resend_queue)

CVE-2026-4390 is a use-after-free in TeamSpeak 3 Server's process_resend_queue function within the Connection State Management component. An attacker sends a duplicate clientinit handshake message in rapid succession over UDP port 9987, triggering a race condition. The error handler removes the client from one internal lookup table but leaves a stale reference in a second (client-ID-based) table. When the resend-queue timer fires and the attacker later acknowledges the error packet, the server dereferences a freed ResendingPacket structure — classic dangling pointer. Affected versions are 3.13.0 through 3.13.7; the TeamSpeak SDK server-side library through 3.3.1 is also vulnerable. The fix ships in TeamSpeak 3 Server 3.13.8 and SDK 3.5.0.

The third-party NVD/VulDB score of 5.4 MEDIUM (using A:L) materially understates the risk. TeamSpeak's own advisory — TS-SA-2026-001 — scores this 7.1 HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H), correctly recognizing that a reliable, repeatable server crash is A:H, not A:L. The modzero research blog further reveals the attack fires during the handshake *before* full client authentication completes, meaning the PR:L rating is generous — most TeamSpeak 3 servers require zero credentials to initiate the handshake. RCE remains unproven due to per-thread tcache segregation and the three-layer pointer chain, but the DoS is reliable and the public PoC lowers the bar to script-kiddie level.

Sources.

1. TeamSpeak Security Advisory TS-SA-2026-001
2. modzero Advisory MZ-26-01
3. modzero Blog — Please Do Not Hack Me
4. born0monday PoC Repository (GitHub)
5. SentinelOne Vulnerability Database — CVE-2026-4390
6. OpenCVE — CVE-2026-4390
7. ESAGAMES — TeamSpeak 3 Vulnerability Guide

Run this script on each host running TeamSpeak 3 Server as any user who can execute the ts3server binary. Pass the binary path as an argument: bash check_cve_2026_4390.sh /opt/teamspeak3-server_linux_amd64/ts3server. No elevated privileges required.

#!/bin/bash
# CVE-2026-4390 Vulnerability Check — TeamSpeak 3 Server
# Checks installed ts3server version against the fixed release.
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN
set -uo pipefail

FIXED="3.13.8"
TS3="${1:-}"

if [ -z "$TS3" ]; then
  for candidate in \
    /opt/teamspeak3-server_linux_amd64/ts3server \
    /opt/teamspeak/ts3server \
    /home/teamspeak/ts3server \
    /usr/local/bin/ts3server; do
    if [ -x "$candidate" ]; then
      TS3="$candidate"
      break
    fi
  done
fi

if [ -z "$TS3" ] || [ ! -f "$TS3" ]; then
  echo "UNKNOWN — ts3server binary not found. Pass path as argument."
  exit 2
fi

# Extract version from ts3server version output
VER=$("$TS3" version 2>/dev/null | grep -oP '[0-9]+\.[0-9]+\.[0-9]+' | head -1) || true

# Fallback: check CHANGELOG in same directory
if [ -z "$VER" ]; then
  DIR=$(dirname "$TS3")
  if [ -f "$DIR/CHANGELOG" ]; then
    VER=$(grep -oP '[0-9]+\.[0-9]+\.[0-9]+' "$DIR/CHANGELOG" | head -1) || true
  fi
fi

if [ -z "$VER" ]; then
  echo "UNKNOWN — could not determine TeamSpeak 3 Server version."
  exit 2
fi

# Compare: if FIXED sorts first or equal, version is patched
if printf '%s\n' "$FIXED" "$VER" | sort -V | head -1 | grep -qx "$FIXED"; then
  echo "PATCHED — TeamSpeak 3 Server $VER (>= $FIXED)"
  exit 0
else
  echo "VULNERABLE — TeamSpeak 3 Server $VER (needs >= $FIXED)"
  exit 1
fi