Vulnerability · Published Nov 4, 2026 · Assigned by VulnCheck

CVE-2026-122126reSIProcate reTurn client through 1.14.0 Heap Buffer Overflow via TurnTcpSocket

Medium 5.9

In plain English

A medium-severity heap buffer overflow in resiprocate from resiprocate. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.4%top 69.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

reSIProcate reTurn client through 1.14.0 contains a heap buffer overflow in TurnTcpSocket::handleReadHeader(), which TurnTlsSocket inherits, that allows malicious TURN servers or on-path attackers to overwrite memory via oversized frame lengths. Attackers can send STUN or ChannelData frames declaring up to 65535 bytes, writing roughly 57 KB past the fixed 8192-byte mReadBuffer and crashing the client. Only the synchronous TCP and TLS client is affected; the asynchronous client (TurnAsyncSocket) and the reTurn server are not.

Affected products (as reported)

Vendor	Product	Versions
resiprocate	resiprocate	0 – through 1.14.0

Weakness: CWE-122 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Pull Request #496 issue-tracking, patch
Patch Commit patch
https://github.com/resiprocate/resiprocate product
https://github.com/resiprocate/resiprocate/blob/resiprocate-1.14.0/reTurn/client/TurnTcpSocket.cxx#L124-L147 technical-description
VulnCheck Advisory: reSIProcate reTurn client through 1.14.0 Heap Buffer Overflow via TurnTcpSocket third-party-advisory