CVE-2026-43994: Coturn buffer overflow (CVSS 8.1)

Description

Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.10.0 contain a stack buffer overflow in decode_oauth_token_gcm(). A uint16_t nonce_len field read from an attacker-supplied OAuth access token (0-65535) is passed directly to memcpy() as the copy length into a 256-byte stack buffer (oauth_encrypted_block.nonce[256]) without bounds checking. The overflow occurs before AES-GCM authentication is verified, the attacker does not need to know the OAuth key or produce a valid AES-GCM token. Up to 735 bytes of attacker-controlled data are written past the buffer, may corrupt adjacent stack data, including control-flow data depending on compiler, ABI, and mitigations. Requires --oauth mode (non-default). This may provide a plausible RCE primitive depending on exploit mitigations; because coturn is widely deployed for WebRTC TURN/STUN and --oauth is commonly recommended, impact can be broad. This issue has been fixed in version 4.10.0.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityHigh

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Coturn< 4.10.0

Remediation

Fixed in

Coturn≥ 4.10.0

Patch & vendor advisories

https://github.com/coturn/coturn/security/advisories/GHSA-74pg-rfh2-5qw5

References

https://github.com/coturn/coturn/releases/tag/4.10.0Release Notes
https://github.com/coturn/coturn/security/advisories/GHSA-74pg-rfh2-5qw5ExploitMitigationVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-43994 being actively exploited?

CVE-2026-43994 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.68%.

How severe is CVE-2026-43994?

CVE-2026-43994 has a CVSS 3.1 base score of 8.1, rated high. EPSS estimates a 0.68% probability of exploitation.

Which products are affected by CVE-2026-43994?

Affected products include Coturn.

How do I fix CVE-2026-43994?

Upgrade affected software to a fixed version, for example Coturn 4.10.0 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-43994 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo