CVE-2026-40613

OVERVIEW CVE-2026-40613 is a memory alignment vulnerability affecting coturn, a free and open-source TURN/STUN server implementation. The vulnerability exists in the STUN/TURN attribute parsing functions, which perform unsafe pointer casts from 8-bit to 16-bit unsigned integers without validating proper memory alignment. When an attacker sends a crafted STUN message with misaligned attribute boundaries, the resulting memory access triggers a SIGBUS signal on ARM64 architectures with strict alignment enforcement, causing immediate process termination. The vulnerability was resolved in coturn version 4.10.0. SEVERITY The vulnerability carries a CVSS 3.1 score of 7.5 (HIGH) with a network attack vector, low complexity, and no authentication requirements. The attack is straightforward and can be executed by an unauthenticated remote attacker without user interaction. While the vulnerability does not compromise confidentiality or integrity, it enables complete availability disruption through denial of service, as a single crafted UDP packet can crash any ARM64 coturn deployment. EXPLOITATION STATUS There is currently no evidence of active exploitation in the wild. The EPSS score of 0.000780000 indicates this vulnerability is not among commonly exploited issues. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog, and no public exploit code or significant community attention has been reported. However, organizations operating coturn on ARM64 architecture should prioritize patching to version 4.10.0 to prevent opportunistic attacks.