PT-2026-44050 · Undefined · Undefined
CVSS v2.0
5.5
Medium
| Vector | AV:N/AC:L/Au:S/C:N/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
TeamSpeak 3 Server versions prior to 3.13.8
Description
A use after free issue exists in the Connection State Management component. The flaw occurs when the server receives two clientinit packets in rapid succession on UDP port 9987. While one packet completes the handshake, the other triggers an error path that deletes only the endpoint map entry. Subsequently, the
process resend queue() function resolves a client ID of 0 and frees the ResendingPacket structure, but the address remains stored in the ACK slot of a successful client. When a corresponding ACK arrives, the process received ack() function attempts to access the freed structure and invoke a virtual method, potentially leading to a remote denial of service.Recommendations
Update to version 3.13.8.
Fix
DoS
Use After Free
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Undefined