Coturn: Versions prior to 4.10.0 contain a stack buffer overflow in decode_oauth_token_gcm(). (CVE-2026-43994)

Coturn, an open source TURN and STUN server implementation, has a stack buffer overflow vulnerability (CVE-2026-43994) in versions prior to 4.10.0. The vulnerability is due to a uint16_t nonce_len field extracted from an attacker-controlled OAuth access token being used directly as the memcpy length into a fixed 256-byte stack buffer without bounds checking. This overflow can write up to 735 bytes past the buffer, potentially corrupting adjacent stack data including control-flow information. The overflow happens before AES-GCM authentication verification, so the attacker does not need to know the OAuth key or produce a valid token. Exploitation requires the server to be running with --oauth mode enabled. The vulnerability may enable remote code execution depending on the target environment's exploit mitigations. The issue is fixed in Coturn version 4.10.0.

Successful exploitation of this vulnerability can lead to stack buffer overflow, which may corrupt adjacent stack data including control-flow data. This could potentially allow remote code execution. The vulnerability is exploitable without authentication or valid OAuth tokens, but requires the --oauth mode to be enabled. Given Coturn's widespread use in WebRTC TURN/STUN services and the common recommendation to enable --oauth mode, the impact can be broad. The CVSS v3.1 score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, and full confidentiality, integrity, and availability impact.

A fix is available in Coturn version 4.10.0. Users should upgrade to version 4.10.0 or later to remediate this vulnerability. Until upgraded, disabling the --oauth mode (if enabled) will prevent exploitation as the vulnerability requires this mode. No other specific mitigations are indicated.