CVE-2026-4391

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4391", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-18T15:05:58.566Z", "datePublished": "2026-05-27T16:45:07.874Z", "dateUpdated": "2026-11-13T17:14:23.184Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-11-13T17:14:23.184Z"}, "title": "TeamSpeak 3 Server ECC Key heap-based overflow", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-122", "lang": "en", "description": "Heap-based Buffer Overflow"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-119", "lang": "en", "description": "Memory Corruption"}]}], "affected": [{"vendor": "n/a", "product": "TeamSpeak 3 Server", "versions": [{"version": "3.13.0", "status": "affected"}, {"version": "3.13.1", "status": "affected"}, {"version": "3.13.2", "status": "affected"}, {"version": "3.13.3", "status": "affected"}, {"version": "3.13.4", "status": "affected"}, {"version": "3.13.5", "status": "affected"}, {"version": "3.13.6", "status": "affected"}, {"version": "3.13.7", "status": "affected"}, {"version": "3.13.8", "status": "affected"}, {"version": "3.13.9", "status": "unaffected"}], "cpes": ["cpe:2.3:a:teamspeak_3_server:teamspeak_3_server:*:*:*:*:*:*:*:*"], "modules": ["ECC Key Parser"]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in TeamSpeak 3 Server up to 3.13.8. This vulnerability affects unknown code of the component ECC Key Parser. Such manipulation leads to heap-based buffer overflow. The attack may be launched remotely. Upgrading to version 3.13.9 is able to resolve this issue. It is suggested to upgrade the affected component. The vendor explains: \"We have just released TeamSpeak 3 Server 3.13.9 to address a remaining variant of CVE-2026-4391, affecting ECC key parsing during the connection handshake. The original fix released with 3.13.8 did not cover this additional variant, which could allow an unauthenticated remote attacker to crash the server using specially crafted input.\""}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:OF/RC:C"}}], "timeline": [{"time": "2026-05-27T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-05-27T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-11-13T18:18:44.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Michael Imfeld (modzero)", "type": "finder"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/366315", "name": "VDB-366315 | TeamSpeak 3 Server ECC Key heap-based overflow", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/366315/cti", "name": "VDB-366315 | CTI Indicators (IOB, IOC)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-4391", "name": "CVE-2026-4391 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://modzero.com/en/advisories/mz-26-01-teamspeak/", "tags": ["related"]}, {"url": "https://files.teamspeak-services.com/docs/security/TS-SA-2026-001.html", "tags": ["related"]}, {"url": "https://www.teamspeak.com/en/downloads/#server", "tags": ["patch"]}, {"url": "https://community.teamspeak.com/t/teamspeak-3-server-3-13-9-security-update/65759", "tags": ["patch"]}], "x_generator": ["VulDB PVTS v202611"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-27T18:45:12.171333Z", "id": "CVE-2026-4391", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T18:46:24.200Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4391", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-27T18:45:12.171333Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T18:46:19.063Z"}}], "cna": {"title": "TeamSpeak 3 Server ECC Key heap-based overflow", "credits": [{"lang": "en", "type": "finder", "value": "Michael Imfeld (modzero)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:teamspeak_3_server:teamspeak_3_server:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["ECC Key Parser"], "product": "TeamSpeak 3 Server", "versions": [{"status": "affected", "version": "3.13.0"}, {"status": "affected", "version": "3.13.1"}, {"status": "affected", "version": "3.13.2"}, {"status": "affected", "version": "3.13.3"}, {"status": "affected", "version": "3.13.4"}, {"status": "affected", "version": "3.13.5"}, {"status": "affected", "version": "3.13.6"}, {"status": "affected", "version": "3.13.7"}, {"status": "unaffected", "version": "3.13.8"}]}], "timeline": [{"lang": "en", "time": "2026-05-27T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-05-27T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-05-27T18:26:06.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/366315", "name": "VDB-366315 | TeamSpeak 3 Server ECC Key heap-based overflow", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/366315/cti", "name": "VDB-366315 | CTI Indicators (IOB, IOC)", "tags": ["signature", "permissions-required"]}, {"url": "https://modzero.com/en/advisories/mz-26-01-teamspeak/", "tags": ["related"]}, {"url": "https://files.teamspeak-services.com/docs/security/TS-SA-2026-001.html", "tags": ["related"]}, {"url": "https://www.teamspeak.com/en/downloads/#server", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in TeamSpeak 3 Server up to 3.13.7. This vulnerability affects unknown code of the component ECC Key Parser. Such manipulation leads to heap-based buffer overflow. The attack may be launched remotely. Upgrading to version 3.13.8 is able to resolve this issue. It is suggested to upgrade the affected component."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "Heap-based Buffer Overflow"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "Memory Corruption"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-05-27T16:45:07.874Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4391", "state": "PUBLISHED", "dateUpdated": "2026-05-27T18:46:24.200Z", "dateReserved": "2026-03-18T15:05:58.566Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-05-27T16:45:07.874Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:teamspeak_3_server:teamspeak_3_server:*:*:*:*:*:*:*:*"], "modules": ["ECC Key Parser"], "product": "TeamSpeak 3 Server", "vendor": "n/a", "versions": [{"status": "affected", "version": "3.13.0"}, {"status": "affected", "version": "3.13.1"}, {"status": "affected", "version": "3.13.2"}, {"status": "affected", "version": "3.13.3"}, {"status": "affected", "version": "3.13.4"}, {"status": "affected", "version": "3.13.5"}, {"status": "affected", "version": "3.13.6"}, {"status": "affected", "version": "3.13.7"}, {"status": "affected", "version": "3.13.8"}, {"status": "unaffected", "version": "3.13.9"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in TeamSpeak 3 Server up to 3.13.8. This vulnerability affects unknown code of the component ECC Key Parser. Such manipulation leads to heap-based buffer overflow. The attack may be launched remotely. Upgrading to version 3.13.9 is able to resolve this issue. It is suggested to upgrade the affected component. The vendor explains: \"We have just released TeamSpeak 3 Server 3.13.9 to address a remaining variant of CVE-2026-4391, affecting ECC key parsing during the connection handshake. The original fix released with 3.13.8 did not cover this additional variant, which could allow an unauthenticated remote attacker to crash the server using specially crafted input.\""}], "id": "CVE-2026-4391", "lastModified": "2026-11-13T18:17:43.060", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4391", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-27T18:45:12.171333Z", "version": "2.0.3"}}]}, "published": "2026-05-27T18:16:28.607", "references": [{"source": "cna@vuldb.com", "url": "https://community.teamspeak.com/t/teamspeak-3-server-3-13-9-security-update/65759"}, {"source": "cna@vuldb.com", "url": "https://files.teamspeak-services.com/docs/security/TS-SA-2026-001.html"}, {"source": "cna@vuldb.com", "url": "https://modzero.com/en/advisories/mz-26-01-teamspeak/"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-4391"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/366315"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/366315/cti"}, {"source": "cna@vuldb.com", "url": "https://www.teamspeak.com/en/downloads/#server"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-122"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.13.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.13.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.13.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.13.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.13.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.13.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.13.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.13.7"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "3.13.8"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "TeamSpeak 3 Server", "source": "cna", "vendor": "n/a"}, "product": "teamspeak_3_server", "vendor": "teamspeak_3_server"}], "created": "2026-05-27T19:30:35.583819+00:00", "updated": "2026-05-28T04:15:06.716441+00:00", "vendors": ["teamspeak_3_server", "teamspeak_3_server$PRODUCT$teamspeak_3_server"]}