CVE-2026-43994— Coturn: Stack buffer overflow in decode_oauth_token_gcm()

Coturn: Stack buffer overflow in decode_oauth_token_gcm()

Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.10.0 contain a stack buffer overflow in decode_oauth_token_gcm(). A uint16_t nonce_len field read from an attacker-supplied OAuth access token (0-65535) is passed directly to memcpy() as the copy length into a 256-byte stack buffer (oauth_encrypted_block.nonce[256]) without bounds checking. The overflow occurs before AES-GCM authentication is verified, the attacker does not need to know the OAuth key or produce a valid AES-GCM token. Up to 735 bytes of attacker-controlled data are written past the buffer, may corrupt adjacent stack data, including control-flow data depending on compiler, ABI, and mitigations. Requires --oauth mode (non-default). This may provide a plausible RCE primitive depending on exploit mitigations; because coturn is widely deployed for WebRTC TURN/STUN and --oauth is commonly recommended, impact can be broad. This issue has been fixed in version 4.10.0.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

未进行输入大小检查的缓冲区拷贝(传统缓冲区溢出)

Coturn 缓冲区错误漏洞

Coturn是Coturn组织开源的一款TURN(VoIP媒体业务NAT穿越服务器和网关)和STUN(用户数据报协议简单穿越网络地址转换器)Server的开源实现。 Coturn 4.10.0之前版本存在缓冲区错误漏洞，该漏洞源于decode_oauth_token_gcm()函数中存在栈缓冲区溢出，攻击者提供的OAuth访问令牌中的nonce_len字段未进行边界检查直接传递给memcpy()，导致最多735字节的攻击者可控数据写入256字节栈缓冲区之后，可能破坏相邻栈数据，包括控制流数据，从而可能实现

N/A

N/A