CVE-2026-122126: reSIProcate reTurn client through 1.14.0 Heap Buffer Overflow via TurnTcpSocket
reSIProcate reTurn client through 1.14.0 contains a heap buffer overflow in TurnTcpSocket::handleReadHeader() that allows malicious TURN servers to overwrite memory via oversized frame lengths. Attackers can send STUN or ChannelData frames declaring up to 65535 bytes, writing roughly 57 KB past the fixed 8192-byte mReadBuffer and crashing the client.
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the reSIProcate reTurn client version 1.14.0 or earlier are exposed when they connect to a malicious TURN server. The issue is in TURN-over-TCP frame handling.
What must an attacker control to exploit this?
An attacker needs to operate or impersonate a TURN server that the client connects to. They can send STUN or ChannelData frames with oversized declared lengths of up to 65535 bytes.
What is the likely impact of exploitation?
Oversized frames can write roughly 57 KB beyond the fixed 8192-byte read buffer. The described outcome is a client crash, resulting in denial of service.
How can I determine whether an instance is affected?
Check whether the application uses the reSIProcate reTurn client and whether its version is 1.14.0 or earlier. Also identify whether the client connects to TURN servers over TCP.