Stack Buffer Overflow Vulnerability in Coturn TURN and STUN Server

CVE-2026-43994

What is CVE-2026-43994?

Coturn, a widely used open-source implementation of TURN and STUN protocols, is susceptible to a stack buffer overflow vulnerability due to improper handling of the nonce length from a user-supplied OAuth access token. When a poorly constructed OAuth token is provided, the length parameter can cause memcpy() to overwrite the stack buffer without bounds checking, potentially leading to arbitrary code execution and compromising adjacent memory. This vulnerability is particularly concerning as it may allow attackers to exploit the system with significant ramifications, particularly in environments where Coturn is deployed for WebRTC applications. The issue has been addressed in version 4.10.0.

References