CVE-2026-40613

High

Description

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN attribute parsing functions in coturn perform unsafe pointer casts from uint8_t * to uint16_t * without alignment checks. When processing a crafted STUN message with odd-aligned attribute boundaries, this results in misaligned memory reads at ns_turn_msg.c. On ARM64 architectures (AArch64) with strict alignment enforcement, this causes a SIGBUS signal that immediately kills the turnserver process. An unauthenticated remote attacker can crash any ARM64 coturn deployment by sending a single crafted UDP packet. This vulnerability is fixed in 4.10.0.

SeverityHigh

CVSS7.5

Exploit probability—

ProductCoturn

PublishedApr 21, 2026

First seenApr 21, 2026

Weakness typeCWE-704CWE-704

How to fix

Update

coturn_project coturn4.10.0 or later

Affected products

Product	Affected versions	Fixed in
coturn_project coturn	v < 4.10.0	4.10.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.