CVE-2026-43994: Critical Stack Buffer Overflow in Coturn OAuth Token Handler

Technical summary

The vulnerability exists in the decode_oauth_token_gcm() function, which processes OAuth access tokens in Coturn. The function reads a uint16_t nonce_len field (capable of values 0–65535) from an attacker-supplied OAuth token and passes it directly as the copy length parameter to memcpy(), writing into an oauth_encrypted_block.nonce buffer of exactly 256 bytes. No bounds checking is performed. Because the nonce_len field can specify up to 65535 bytes, memcpy() will write approximately 735 bytes past the intended buffer boundary onto the stack. The overflow occurs before AES-GCM authentication is verified, meaning an attacker need not forge a valid cryptographic token or know the OAuth key. The attacker-controlled overflow can corrupt adjacent stack memory, including return addresses and saved registers, depending on compiler optimizations, ABI layout, and deployed security mitigations (stack canaries, ASLR, etc.). This creates a plausible remote code execution primitive.

Business impact

Organizations running Coturn with OAuth enabled—a configuration recommended for security-conscious deployments—face a direct remote code execution risk without authentication. Coturn is extensively deployed as the infrastructure backbone for WebRTC applications across conferencing platforms, gaming, IoT, and real-time communication services. Successful exploitation could allow an attacker to compromise TURN/STUN servers, redirect or eavesdrop on media traffic, disrupt service availability, or pivot to backend systems. The lack of authentication requirements (attacker does not need valid OAuth credentials) dramatically expands the attack surface. Organizations should treat this as a critical infrastructure vulnerability, particularly if Coturn is internet-exposed.

Affected systems

Coturn versions prior to 4.10.0 are vulnerable. The vulnerability is only active when Coturn is started with the --oauth mode flag; default configurations without this flag are not affected. However, --oauth is widely recommended in production deployments to secure access to TURN resources, making many real-world instances vulnerable. Any organization using Coturn for WebRTC, regardless of platform or deployment context, should verify their configuration and version.

Exploitability

Exploitation requires network access to the Coturn server and the ability to send a malformed OAuth token to the vulnerable code path. No authentication or valid credentials are required—the overflow triggers during token parsing, before cryptographic validation. The complexity lies not in gaining access but in reliably controlling the stack layout to achieve code execution, which varies by system architecture, compiler flags, and security mitigations. CVSS reflects this nuance: the score of 8.1 (HIGH) acknowledges high potential impact but moderate attack complexity due to exploitation variability. In well-hardened environments with stack canaries, ASLR, and non-executable stack, exploitation is more difficult but not impossible. In legacy or minimal-mitigation deployments, reliable RCE is plausible.

Remediation

Upgrade Coturn to version 4.10.0 or later immediately. This patch version includes bounds checking in the decode_oauth_token_gcm() function. If immediate patching is not possible, temporarily disable the --oauth mode if operationally feasible, though this may degrade security. Restrict network access to the Coturn server via firewall rules to limit exposure only to trusted networks or clients. Monitor for unexpected crashes or segmentation faults, which may indicate exploitation attempts.

Patch guidance

Coturn 4.10.0 and later contain the fix. Verify the patched version by checking the release notes or via `turnserver -v` after upgrading. Test the patched version in a staging environment before deploying to production, particularly if running custom builds or configurations. Rebuilding from source? Ensure you are using the correct commit that includes the bounds-checking fix—consult the official Coturn repository for the exact revision.

Detection guidance

Monitor Coturn logs for segmentation faults or unexpected crashes. Network-based detection is challenging because the malicious token appears as a legitimate OAuth request on the wire. However, you can identify exploitation attempts by: (1) logging all OAuth token processing failures or malformed tokens; (2) monitoring for abnormal process termination or crash dumps; (3) using stack canary mechanisms (available on most modern systems) to detect buffer overflow attempts. Intrusion detection rules targeting abnormally large nonce_len values in OAuth tokens, if your IDS can parse the token structure, may catch obvious attacks.

Why prioritize this

This vulnerability merits immediate patching because it combines high impact (potential RCE), low barrier to exploitation (no authentication required), and broad exposure (many Coturn deployments use --oauth mode). The timing of the disclosure (June 2026) suggests active awareness in the community. Delaying patching leaves internet-exposed Coturn infrastructure open to opportunistic or targeted compromise.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects: (1) High confidentiality, integrity, and availability impact (RCE potential); (2) Network-based attack vector requiring no privileges; (3) Attack complexity marked as HIGH due to exploitation variability across different system configurations and mitigations; (4) No user interaction required. The HIGH complexity prevents a CRITICAL rating, but the potential for stack-based code execution and broad real-world deployment of vulnerable Coturn instances justifies the upper end of HIGH severity.

Frequently asked questions