Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN attribute parsing functions in coturn perform unsafe pointer…

CVE-2026-40613 affects Coturn TURN/STUN server versions prior to 4.10.0. The vulnerability involves unsafe pointer casts in STUN/TURN attribute parsing functions that perform casts from uint8_t to uint16_t without alignment checks. When processing crafted STUN messages with odd-aligned attribute boundaries, this causes misaligned memory reads in ns_turn_msg.c. On ARM64 architectures with strict alignment enforcement, this triggers a SIGBUS signal that immediately crashes the turnserver process. An unauthenticated remote attacker can exploit this by sending a single crafted UDP packet to crash any ARM64 coturn deployment. The vulnerability is fixed in version 4.10.0.