CVE-2026-4390

Name of the Vulnerable Software and Affected Versions TeamSpeak 3 Server versions prior to 3.13.8

Description A use after free issue exists in the Connection State Management component. The flaw occurs when the server receives two clientinit packets in rapid succession on UDP port 9987. While one packet completes the handshake, the other triggers an error path that deletes only the endpoint map entry. Subsequently, the process resend queue() function resolves a client ID of 0 and frees the ResendingPacket structure, but the address remains stored in the ACK slot of a successful client. When a corresponding ACK arrives, the process received ack() function attempts to access the freed structure and invoke a virtual method, potentially leading to a remote denial of service.

Recommendations Update to version 3.13.8.