CVE-2026-40613: Coturn: Misaligned Memory Access in coturn STUN Attribute Parser (Remote DoS on ARM64)
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN attribute parsing functions in coturn perform unsafe pointer casts from uint8t to uint16t without alignment checks. When processing a crafted STUN message with odd-aligned attribute boundaries, this results in misaligned memory reads at nsturnmsg.c. On ARM64 architectures (AArch64) with strict alignment enforcement, this causes a SIGBUS signal that immediately kills the turnserver process. An unauthenticated remote attacker can crash any ARM64 coturn deployment by sending a single crafted UDP packet. This vulnerability is fixed in 4.10.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
coturnto a version that resolves this vulnerability.Fixed in 4.10.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40613?
CVE-2026-40613 has a severity rating of high due to the potential for remote denial of service attacks on ARM64 architectures.
How do I fix CVE-2026-40613?
To resolve CVE-2026-40613, upgrade your Coturn software to version 4.10.0 or later.
What is CVE-2026-40613?
CVE-2026-40613 refers to a vulnerability in Coturn that allows remote denial of service due to misaligned memory access in the STUN attribute parser.
Which versions of Coturn are affected by CVE-2026-40613?
CVE-2026-40613 affects all versions of Coturn prior to 4.10.0.
What can attackers achieve with CVE-2026-40613?
Attackers can exploit CVE-2026-40613 to cause a denial of service by exploiting the misaligned memory access on ARM64 platforms.