Secuno
ENNL
Book demo

CVE-2026-40613

Coturn vulnerability

7.5 HIGHPublic exploitEPSS 1.52%
  1. Published21 Apr 2026

Description

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN attribute parsing functions in coturn perform unsafe pointer casts from uint8_t * to uint16_t * without alignment checks. When processing a crafted STUN message with odd-aligned attribute boundaries, this results in misaligned memory reads at ns_turn_msg.c. On ARM64 architectures (AArch64) with strict alignment enforcement, this causes a SIGBUS signal that immediately kills the turnserver process. An unauthenticated remote attacker can crash any ARM64 coturn deployment by sending a single crafted UDP packet. This vulnerability is fixed in 4.10.0.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityNone
IntegrityNone
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Coturn< 4.10.0

Remediation

Fixed in
Coturn≥ 4.10.0

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-202498.6
A vulnerability in the certification authentication feature of Internet Key Exchange…
CVE-2026-588229.8
In multiple functions of ftsmooth.c, there is a possible memory safety issue due to…
CVE-2026-286098.8
In read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to…
CVE-2026-158269.8
The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass…
CVE-2026-278099.1
psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to…
CVE-2025-405419.1
An Insecure Direct Object Reference (IDOR) vulnerability exists in Serv-U, which when…

Frequently asked

Is CVE-2026-40613 being actively exploited?

CVE-2026-40613 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 1.52%.

How severe is CVE-2026-40613?

CVE-2026-40613 has a CVSS 3.1 base score of 7.5, rated high. EPSS estimates a 1.52% probability of exploitation.

Which products are affected by CVE-2026-40613?

Affected products include Coturn.

How do I fix CVE-2026-40613?

Upgrade affected software to a fixed version, for example Coturn 4.10.0 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-40613 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.