CVE-2026-40613

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN attribute parsing functions in coturn perform unsafe pointer casts from uint8_t * to uint16_t * without alignment checks. When processing a crafted STUN message with odd-aligned attribute boundaries, this results in misaligned memory reads at ns_turn_msg.c. On ARM64 architectures (AArch64) with strict alignment enforcement, this causes a SIGBUS signal that immediately kills the turnserver process. An unauthenticated remote attacker can crash any ARM64 coturn deployment by sending a single crafted UDP packet. This vulnerability is fixed in 4.10.0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-704

Affected software

No affected versions have been published.

Timeline

Published: Apr 21, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-406148.8PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is a buffer overflow when decoding CVE-2026-406159.1A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R (version(s): TOTOLINK-X20 CVE-2026-406187.5When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition (VE) without Intel QuickAssist Technology (QAT) or on BIG-IP CVE-2026-406197.8A high security vulnerability affecting Security Center main server installations has been identified. It could allow an attacker with local CVE-2026-40627.5The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'object_ids' and 'exclude_object_ids' parameters in al CVE-2026-406209.8A vulnerability in SenseLive X3050’s embedded management service allows full administrative control to be established without any form of au CVE-2026-406219.3ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. The affected product may be operated wi CVE-2026-406227.5NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could ex CVE-2026-406238.1A vulnerability in SenseLive X3050's web management interface allows critical system and network configuration parameters to be modified wit CVE-2026-406249.8Improper input validation in AVer PTC500S, PTC115, PTC500+, and PTC115+ cameras may allow a remote, unauthenticated attacker to achieve ar CVE-2026-406279.1An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B202 CVE-2026-406297.5When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connect