Coturn ARM64 Crash: Unauthenticated DoS via Crafted STUN Message

The National Vulnerability Database has disclosed CVE-2026-40613, a high-severity vulnerability (CVSS 7.5) affecting Coturn, a widely used open-source TURN/STUN server. This flaw, present in versions prior to 4.10.0, stems from unsafe pointer casts in STUN/TURN attribute parsing functions. Specifically, it involves misaligned memory reads when processing crafted STUN messages with odd-aligned attribute boundaries.

For ARM64 architectures (AArch64) with strict alignment enforcement, this vulnerability is critical. An unauthenticated remote attacker can exploit it by sending a single, specially crafted UDP packet, triggering a SIGBUS signal that immediately crashes the turnserver process. This effectively leads to a denial of service for any affected ARM64 Coturn deployment. The fix is available in Coturn version 4.10.0.

This isn’t just a bug; it’s a direct route to service disruption. Attackers don’t need credentials or complex exploits – just one malformed packet. For organizations relying on Coturn for real-time communication, this means a trivial path to take down critical infrastructure. The attacker’s calculus is simple: low effort, high impact.