CVE-2026-40613

HighPublic PoC

Published: 21 April 2026

Published

21 April 2026

Modified

24 April 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score 0.0019 40.7th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-40613 is a high-severity Incorrect Type Conversion or Cast (CWE-704) vulnerability in Coturn Project Coturn. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 40.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Application or System Exploitation (T1499.004). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly mitigates the vulnerability by requiring timely remediation of the known flaw through patching Coturn to version 4.10.0 or later.

SC-5 Denial-of-service Protection good match

prevent

Protects against denial-of-service attacks by limiting the effects of crafted UDP packets that crash the turnserver process.

SI-10 Information Input Validation partial match

prevent

Requires validation of incoming STUN/TURN messages to check attribute alignment and structure, preventing unsafe pointer casts.

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

attack.mitre.org →

Why these techniques?

The vulnerability enables remote unauthenticated exploitation of a parsing flaw in the Coturn TURN/STUN server to trigger a process crash via a single crafted UDP packet, directly mapping to Endpoint Denial of Service through Application or System Exploitation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN attribute parsing functions in coturn perform unsafe pointer casts from uint8_t * to uint16_t * without alignment checks. When processing a crafted STUN…

message with odd-aligned attribute boundaries, this results in misaligned memory reads at ns_turn_msg.c. On ARM64 architectures (AArch64) with strict alignment enforcement, this causes a SIGBUS signal that immediately kills the turnserver process. An unauthenticated remote attacker can crash any ARM64 coturn deployment by sending a single crafted UDP packet. This vulnerability is fixed in 4.10.0.

Deeper analysisAI

CVE-2026-40613 is a vulnerability in Coturn, a free open source implementation of TURN and STUN servers, affecting versions prior to 4.10.0. The issue stems from unsafe pointer casts in the STUN/TURN attribute parsing functions within ns_turn_msg.c, where uint8_t pointers are cast to uint16_t pointers without alignment checks. Processing a crafted STUN message with odd-aligned attribute boundaries triggers misaligned memory reads, which on ARM64 (AArch64) architectures with strict alignment enforcement results in a SIGBUS signal that terminates the turnserver process.

An unauthenticated remote attacker can exploit this vulnerability by sending a single crafted UDP packet to any ARM64 Coturn deployment, causing an immediate denial-of-service crash of the turnserver process. The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects its network accessibility, low complexity, and high availability impact with no privileges required.

The Coturn GitHub security advisory (GHSA-j662-9wcj-mf36) confirms the vulnerability and states it is fixed in version 4.10.0, recommending users upgrade to this release or later to mitigate the issue.