A weakness has been identified in TeamSpeak 3 Server up to 3

CVE-2026-4390 is a use-after-free in TeamSpeak 3 Server connection state management, specifically the process_resend_queue path, affecting TeamSpeak 3 Server 3.13.7 and earlier; TeamSpeak also says the same flaw affects server-side SDK integrations 3.3.1 and earlier. The practical impact documented by TeamSpeak is authenticated remote denial of service: a logged-in remote user can send crafted traffic that destabilizes the service or forces a server restart.

The raw memory-corruption label makes this look scarier than the real-world path. Yes, use-after-free bugs can sometimes become code execution, but the published vendor impact for this CVE is DoS, not RCE, and the chain starts with low-privileged authenticated access on a relatively niche service. That attacker-position requirement, plus no KEV listing, no vendor-confirmed exploitation, and a near-floor EPSS, pushes this back into routine-but-real patching rather than emergency response.

Why this verdict

• Start at the vendor baseline, then cut for attacker position: TeamSpeak's own advisory calls this 7.1 HIGH, but the path requires authenticated remote access. That implies prior access, stolen creds, invited membership, or weak join controls; this is not an unauthenticated edge exploit.
• Population is narrower than the score implies: TeamSpeak servers are internet-exposed in some environments, but they are not a universal enterprise platform. The reachable population is materially smaller than for VPNs, browsers, email, remote desktop gateways, or hypervisors.
• Impact is operationally real but technically bounded: the vendor-documented outcome is service instability or restart. For a 10,000-host team, that is an application outage problem, not evidence of broad privilege escalation or domain compromise.

Why not higher?

Because the chain is post-access: low-privileged authenticated remote access is required before the bug matters. Also, the primary-source material reviewed does not show active exploitation, KEV inclusion, or a published working RCE, so there is no reason to treat this like an internet-wormable edge bug.

Why not lower?

It still deserves a real ticket because the target is often network-exposed and the bug class is memory corruption, not harmless input validation. If your organization actually relies on TeamSpeak for operations, even a DoS-only authenticated bug can disrupt coordination at the wrong moment.

1. Restrict who can reach the service — Put TeamSpeak behind VPN, IP allowlists, or tight perimeter ACLs wherever possible so random internet users cannot even attempt the authenticated stage. For a MEDIUM verdict there is no noisgate mitigation SLA; use this as exposure reduction while you work inside the remediation window.
2. Tighten account admission — Review public registration, invite links, shared credentials, and stale user accounts so PR:L is harder to obtain in practice. This directly attacks the biggest amplifier in the chain: the attacker needs a valid user context before the bug is reachable.
3. Watch for crash-and-reconnect patterns — Alert on repeated TeamSpeak process restarts, watchdog recoveries, and bursts of failed or churn-heavy session activity. This will not prevent exploitation, but it shortens detection time for abuse against still-unpatched instances.
4. Segregate the host — Keep the TeamSpeak service on a non-privileged, isolated host/container with minimal adjacent trust. If the memory-corruption story ever evolves beyond DoS, you want the blast radius to stop at that service boundary.

Run this on the Linux/macOS host that runs TeamSpeak 3 Server. Save it as check-ts3-cve-2026-4390.sh and run bash check-ts3-cve-2026-4390.sh /opt/teamspeak3-server or point it at a log directory/file; it needs read access only to the install path and logs.

#!/usr/bin/env bash
# check-ts3-cve-2026-4390.sh
# Determine whether a TeamSpeak 3 Server install is vulnerable to CVE-2026-4390
# by extracting the installed server version from logs, binary strings, or directory names.
# Exit codes:
#   0 = PATCHED
#  10 = VULNERABLE
#  20 = UNKNOWN

set -u

TARGET="${1:-.}"
FIXED="3.13.8"
FOUND_VERSION=""
SOURCE=""

verlte() {
  [ "$1" = "$2" ] && return 0
  local first
  first=$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)
  [ "$first" = "$1" ]
}

extract_from_text() {
  grep -Eo 'TeamSpeak 3 Server[[:space:]]+[0-9]+\.[0-9]+\.[0-9]+' 2>/dev/null | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | head -n1
}

if [ -f "$TARGET" ]; then
  FOUND_VERSION=$(cat "$TARGET" | extract_from_text || true)
  if [ -n "$FOUND_VERSION" ]; then SOURCE="file:$TARGET"; fi
fi

if [ -z "$FOUND_VERSION" ] && [ -d "$TARGET" ]; then
  if [ -d "$TARGET/logs" ]; then
    FOUND_VERSION=$(grep -RhoE 'TeamSpeak 3 Server[[:space:]]+[0-9]+\.[0-9]+\.[0-9]+' "$TARGET/logs" 2>/dev/null | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | head -n1 || true)
    if [ -n "$FOUND_VERSION" ]; then SOURCE="logs:$TARGET/logs"; fi
  fi
fi

if [ -z "$FOUND_VERSION" ] && [ -d "$TARGET" ]; then
  for bin in "$TARGET/ts3server" "$TARGET/ts3server.exe"; do
    if [ -f "$bin" ]; then
      FOUND_VERSION=$(strings "$bin" 2>/dev/null | extract_from_text || true)
      if [ -n "$FOUND_VERSION" ]; then SOURCE="binary:$bin"; break; fi
    fi
  done
fi

if [ -z "$FOUND_VERSION" ] && [ -d "$TARGET" ]; then
  FOUND_VERSION=$(basename "$TARGET" | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | head -n1 || true)
  if [ -n "$FOUND_VERSION" ]; then SOURCE="dirname:$TARGET"; fi
fi

if [ -z "$FOUND_VERSION" ]; then
  echo "UNKNOWN unable_to_determine_version target=$TARGET fixed=$FIXED"
  exit 20
fi

if verlte "$FOUND_VERSION" "$FIXED" && [ "$FOUND_VERSION" != "$FIXED" ]; then
  echo "VULNERABLE version=$FOUND_VERSION fixed=$FIXED source=$SOURCE cve=CVE-2026-4390"
  exit 10
fi

if [ "$FOUND_VERSION" = "$FIXED" ] || ! verlte "$FOUND_VERSION" "$FIXED"; then
  echo "PATCHED version=$FOUND_VERSION fixed=$FIXED source=$SOURCE cve=CVE-2026-4390"
  exit 0
fi

echo "UNKNOWN version=$FOUND_VERSION fixed=$FIXED source=$SOURCE"
exit 20

Sources

1. NVD CVE-2026-4390
2. TeamSpeak Security Advisory TS-SA-2026-001
3. TeamSpeak community announcement
4. TeamSpeak downloads
5. modzero advisory MZ-26-01
6. CISA Known Exploited Vulnerabilities Catalog
7. TeamSpeak support: server ports
8. Public listings of TeamSpeak 3.13.7 servers