TeamSpeak 3 Server Vulnerabilities (CVE-2026-4390/4391/4392): Update to 3.13.8

TeamSpeak's advisory TS-SA-2026-001 disclosed three High-severity vulnerabilities in TeamSpeak 3 Server 3.13.7 and below. All three are denial-of-service bugs - a remote attacker can crash or restart your voice server, not take it over - and all are fixed in version 3.13.8. Here's the plain-English breakdown and what to do.

What was actually found (and what wasn't)

First, to clear up the rumours: these are denial-of-service vulnerabilities, not a full "TeamSpeak got hacked" remote-code-execution takeover. In practice an attacker can crash your server or force it to restart with crafted network traffic - disruptive, especially mid-event, but not a way to steal your data or run code on the box. The affected version is 3.13.7 and below (not any 3.17 build), and the fix is 3.13.8.

The three vulnerabilities

• CVE-2026-4390 - a use-after-free from inconsistent connection-state handling. An authenticated attacker can trigger a denial-of-service (crash / restart).
• CVE-2026-4391 - a heap-based buffer overflow in ECC key parsing. An unauthenticated attacker can crash the server with crafted input.
• CVE-2026-4392 - an assertion failure triggered by crafted input, again exploitable by an unauthenticated attacker for denial-of-service.

The two unauthenticated bugs (4391 and 4392) are the more worrying pair, because an attacker needs no credentials at all - just the ability to reach your server's port.

Am I affected?

You're affected if you run TeamSpeak 3 Server 3.13.7 or older (or the TeamSpeak SDK server-side integration below 3.5.0). Check your version in the server log at startup or via the admin query interface. If you're on hosted TeamSpeak, your provider may already have patched - ask them.

What to do

• Update TeamSpeak 3 Server to 3.13.8 immediately (SDK users: 3.5.0). This is the real fix.
• Back up your files and database (the ts3server.sqlitedb file, or your MySQL database) before upgrading.
• If you can't update this minute, restrict who can reach the ports with a firewall while you schedule the upgrade - but patching is the only real fix.
• Put the voice server behind DDoS protection, since crash-style attacks and traffic floods often arrive together.

Keeping a voice server healthy

Voice servers are a favourite target because knocking one offline instantly disrupts a community. Beyond patching, the essentials are firewalling the query and voice ports, keeping the server updated, and filtering hostile traffic upstream. Our guide on protecting a TeamSpeak or voice server from DDoS covers the network side, and the game server security checklist covers the rest.

These are crash bugs, not a takeover - but two of them need no login at all. Update to 3.13.8 and put the server behind filtering.