Coturn EUVD-2026-24228

Requires Coturn deployment running on ARM64 (AArch64) architecture with strict alignment enforcement. x86_64 installations are not vulnerable as that architecture tolerates misaligned memory access with performance degradation rather than faults. Network reachability to the TURN/STUN service port (default UDP 3478, or TCP/TLS 5349) is required, meaning the server must be accessible from the attacker's network position. No authentication is required (PR:N in CVSS vector) - the vulnerability exists in the pre-authentication STUN message parsing stage, allowing exploitation before any credential exchange. No specific Coturn configuration setting increases or decreases risk - default installations are vulnerable. The vulnerability affects all deployment modes (TURN relay, STUN-only, containerized, bare-metal) equally on ARM64. Exploitation is limited to availability impact only - attackers cannot gain code execution, read memory, or pivot to other systems through this vulnerability alone (S:U/C:N/I:N in CVSS vector). Detection of exploitation is straightforward: sudden termination with SIGBUS signal in system logs and absence of process restart without external intervention.

This represents a high-severity availability threat with extremely low exploitation complexity against a specific architectural deployment. The CVSS base score of 7.5 reflects the network-accessible, unauthenticated attack vector (AV:N/AC:L/PR:N/UI:N) with high availability impact (A:H). The attack requires only the ability to send UDP packets to the TURN/STUN server port (typically 3478), making it trivially exploitable from any network position that can reach the service. No authentication, user interaction, or complex timing is required. However, real-world risk is constrained by architectural specificity: only ARM64 deployments are affected. Organizations running Coturn on x86_64 infrastructure face no risk from this vulnerability. For ARM64 environments (increasingly common in cloud containerized deployments, edge computing, and IoT gateway scenarios), this is a critical issue enabling single-packet denial of service with immediate service disruption. The vulnerability could be chained with application-layer attacks where availability disruption enables session hijacking or forces fallback to less secure communication paths. No public exploit code is identified at time of analysis, and the CVE is not listed in CISA KEV, but the attack primitive is straightforward once the malformed packet structure is reverse-engineered from the patch. SSVC framework assessment: Exploitation state is 'PoC' (theoretical attack documented in advisory), Automatable is 'yes' (single packet, no authentication), Technical Impact is 'partial' (availability only, no confidentiality or integrity compromise). Priority is high for ARM64 deployments running public-facing Coturn instances, moderate for internal-only ARM64 deployments, and low for x86_64 infrastructure.

An attacker identifies an ARM64-based Coturn server exposed on the public internet, typically through banner grabbing on UDP port 3478 or by observing WebRTC infrastructure in browser developer tools. The attacker crafts a STUN Binding Request message with attribute boundaries positioned at odd byte offsets, violating 16-bit alignment requirements for ARM64 memory access. Sending this single malformed UDP packet to the Coturn server triggers the unsafe pointer cast in ns_turn_msg.c attribute parsing code, causing a misaligned memory read that generates a SIGBUS signal and immediately terminates the turnserver process. All active TURN sessions are dropped, disrupting real-time communication for legitimate users. The attacker can repeat this attack continuously to maintain denial of service with minimal bandwidth cost (single 100-200 byte UDP packet per crash). No authentication or session establishment is required, making this exploitable from any network position with UDP reachability to the target server.