Coturn EUVD-2026-94363

No special conditions - remote unauthenticated exploitation against default configurations of Coturn 4.10.0; the attacker only needs network reachability to the TURN/STUN listener and sends an Allocate request with no credentials, so there is no authentication, user interaction, or non-default setting required. The main limiting factors are impact-side, not access-side: each response leaks only the bounded amount of stack data that fits in the ERROR-CODE reason phrase, the disclosure is probabilistic (depends on residual stack contents), and the leak yields no write/execution capability - its practical value is weakening ASLR and version fingerprinting to support a separate exploit.

This is a genuine but modest-priority issue, best characterized as a moderate-severity information disclosure rather than a critical flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity reachability with no user interaction, which is the worst-case exposure profile for an attack surface - and it aligns well with the description's claim that an unauthenticated TURN Allocate request triggers the leak. However, the impact is deliberately scoped low (VC:L, VI:N, VA:N): the bug leaks fragments of stack memory into the ERROR-CODE reason phrase, weakening ASLR and enabling version fingerprinting, but it provides no code execution, write primitive, or availability impact. No EPSS score was provided, the CVE is NOT in CISA KEV, and no public exploit (POC) is referenced, so there is no public exploit identified at time of analysis. The realistic value to an attacker is as a reconnaissance/pre-exploitation primitive (defeating ASLR ahead of a separate memory-corruption bug) rather than a standalone high-impact vulnerability. Net assessment: the 6.9 base score overstates standalone urgency; treat this as a routine patch-management item unless Coturn is internet-exposed and paired with other memory-safety bugs.

A remote attacker sends a crafted TURN Allocate request without any credentials to an internet-facing Coturn 4.10.0 server. The server's error-response path invokes stun_init_error_response_common_str() with an uninitialized avalue buffer, so strlen() reads past intended data and copies leaked stack bytes - including pointer fragments - into the ERROR-CODE reason phrase returned to the attacker. No public exploit code is referenced, but the trigger is trivial and requires only an unauthenticated STUN/TURN packet.