A critical vulnerability in Coturn allows unauthenticated remote attackers to crash TURN and STUN services on ARM64 hardware, leading to significant service disruption.

The vulnerability exists due to unsafe pointer casting during STUN/TURN attribute parsing, which results in misaligned memory reads. An unauthenticated remote attacker can trigger this flaw by sending a crafted UDP packet, causing a SIGBUS signal that terminates the service on ARM64 systems.

The exploitation of this vulnerability results in a denial of service, rendering communication services that rely on Coturn unavailable. Given that TURN and STUN servers are critical infrastructure for real time communications, such as VoIP and video conferencing, this outage can cause significant operational downtime and disrupt essential business workflows. The CVSS score of 7.5 reflects the high impact on service availability.

Immediate Action: Update the Coturn implementation to version 4.10.0 or later immediately to resolve the unsafe pointer casting issue.

Proactive Monitoring: Monitor server logs for frequent service restarts or unexpected SIGBUS error signals, which may indicate attempted exploitation of this memory alignment flaw.

Compensating Controls: Deploy network level filtering to restrict access to the STUN/TURN UDP ports to trusted IP ranges, thereby limiting the ability of external actors to send crafted packets.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability presents a clear risk of service disruption for any organization utilizing Coturn on ARM64-based infrastructure. Because the flaw can be triggered remotely without authentication, it is imperative that administrators prioritize patching to version 4.10.0. Failure to update leaves production communication services susceptible to trivial denial of service attacks.