CVE-2026-43994 Coturn: Stack buffer overflow in decode_oauth_token_gcm()
Attacker can achieve remote code execution via stack buffer overflow in Coturn's OAuth token decoding when OAuth mode is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43994?
CVE-2026-43994 is a high-severity memory corruption vulnerability in coturn, published on 18 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.10.0 contain a stack buffer overflow in decode_oauth_token_gcm(). A uint16_t nonce_len field read from an attacker-supplied OAuth access token (0-65535) is passed directly to memcpy() as the copy length into a 256-byte stack buffer (oauth_encrypted_block.nonce[256]) without bounds checking. The overflow occurs before AES-GCM authentication is verified, the attacker does not need to know the OAuth key or produce a valid AES-GCM token. Up to 735 bytes of attacker-controlled data are written past the buffer, may corrupt adjacent stack data, including control-flow data depending on compiler, ABI, and mitigations. Requires --oauth mode (non-default). This may provide a plausible RCE primitive depending on exploit mitigations; because coturn is widely deployed for WebRTC TURN/STUN and --oauth is commonly recommended, impact can be broad. This issue has been fixed in version 4.10.0.
Weakness: CWE-120
Which versions are affected by CVE-2026-43994?
It affects 1 product.
Products include Coturn Project Coturn.
How do I fix CVE-2026-43994?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-43994 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-43994 exists.
Other vulnerabilities in coturn
- CVE-2018-4056 SQL injection in coTURN
- CVE-2018-4058 Server-side request forgery in coTURN
- CVE-2026-40613 Coturn: Misaligned Memory Access in coturn STUN Attribute Parser (Remote DoS on ARM64)
- CVE-2026-53450 Coturn: IPv4-mapped 127.0.0.1 bypasses default loopback peer protection
- CVE-2026-53448 Coturn: SQL Injection in HTTPS Admin Panel Delete Operations
Sources
Also known as DEBIAN-CVE-2026-43994, GHSA-74pg-rfh2-5qw5, UBUNTU-CVE-2026-43994.