CVE-2026-40613: coturn_project coturn Incorrect Type Conversion or Cast

Vulnerability summary

CVE-2026-40613 is a high (CVSS 7.5) Incorrect Type Conversion or Cast vulnerability in coturn_project coturn. EPSS estimates a 1.52% chance of exploitation in the next 30 days, higher than 74.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 21-04-2026
   PublishedVulnerability first disclosed.
2. 21-04-2026
   Last modifiedVulnerability information updated.

Description

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN attribute parsing functions in coturn perform unsafe pointer casts from uint8_t * to uint16_t * without alignment checks. When processing a crafted STUN message with odd-aligned attribute boundaries, this results in misaligned memory reads at ns_turn_msg.c. On ARM64 architectures (AArch64) with strict alignment enforcement, this causes a SIGBUS signal that immediately kills the turnserver process. An unauthenticated remote attacker can crash any ARM64 coturn deployment by sending a single crafted UDP packet. This vulnerability is fixed in 4.10.0.

• CWE-704Incorrect Type Conversion or CastThe product does not correctly convert an object, resource, or structure from one type to a different type.