Vulnerability · Published Jun 18, 2026 · Assigned by GitHub_M
CVE-2026-43994Coturn: Stack buffer overflow in decode_oauth_token_gcm()
High 8.1
In plain English
A high-severity buffer overflow in coturn from coturn. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.10.0 contain a stack buffer overflow in decode_oauth_token_gcm(). A uint16_t nonce_len field read from an attacker-supplied OAuth access token (0-65535) is passed directly to memcpy() as the copy length into a 256-byte stack buffer (oauth_encrypted_block.nonce[256]) without bounds checking. The overflow occurs before AES-GCM authentication is verified, the attacker does not need to know the OAuth key or produce a valid AES-GCM token. Up to 735 bytes of attacker-controlled data are written past the buffer, may corrupt adjacent stack data, including control-flow data depending on compiler, ABI, and mitigations. Requires --oauth mode (non-default). This may provide a plausible RCE primitive depending on exploit mitigations; because coturn is widely deployed for WebRTC TURN/STUN and --oauth is commonly recommended, impact can be broad. This issue has been fixed in version 4.10.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | coturn | no fix listed | DEBIAN-CVE-2026-43994 |
| Debian:13 | coturn | no fix listed | DEBIAN-CVE-2026-43994 |
| Debian:14 | coturn | 4.12.0-1 | DEBIAN-CVE-2026-43994 |
| Ubuntu:22.04:LTS | coturn | no fix listed | UBUNTU-CVE-2026-43994 |
| Ubuntu:24.04:LTS | coturn | no fix listed | UBUNTU-CVE-2026-43994 |
| Ubuntu:25.10 | coturn | no fix listed | UBUNTU-CVE-2026-43994 |
| Ubuntu:26.04:LTS | coturn | no fix listed | UBUNTU-CVE-2026-43994 |
| Ubuntu:26.10 | coturn | no fix listed | UBUNTU-CVE-2026-43994 |
Affected products (as reported)
Weakness: CWE-120 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/coturn/coturn/security/advisories/GHSA-74pg-rfh2-5qw5 x_refsource_CONFIRM
- https://github.com/coturn/coturn/releases/tag/4.10.0 x_refsource_MISC