CVE-2026-122126 reSIProcate reTurn client through 1.14.0 Heap Buffer Overflow via TurnTcpSocket

High 8.2 Published 4 Nov 2026 Updated 5 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-122126?

CVE-2026-122126 is a high-severity vulnerability in resiprocate, published on 4 Nov 2026.

Official description

reSIProcate reTurn client through 1.14.0 contains a heap buffer overflow in TurnTcpSocket::handleReadHeader(), which TurnTlsSocket inherits, that allows malicious TURN servers or on-path attackers to overwrite memory via oversized frame lengths. Attackers can send STUN or ChannelData frames declaring up to 65535 bytes, writing roughly 57 KB past the fixed 8192-byte mReadBuffer and crashing the client. Only the synchronous TCP and TLS client is affected; the asynchronous client (TurnAsyncSocket) and the reTurn server are not.

Weakness: CWE-122

Which versions are affected by CVE-2026-122126?

How do I fix CVE-2026-122126?

No fix has been published for CVE-2026-122126 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-122126 being exploited?

There is no known exploitation of CVE-2026-122126 in the wild and no public exploit code.

Sources

Also known as GHSA-32v3-8rp4-cq83, UBUNTU-CVE-2026-122126.