An out-of-bounds read vulnerability in the coturn TURN and STUN server allows unauthenticated attackers to trigger memory access errors, posing a high risk to service stability and data confidentiality.

This vulnerability involves an out-of-bounds read (CWE-125) and a signed-to-unsigned conversion error (CWE-195). These flaws occur during packet processing, allowing an unauthenticated attacker to supply malformed input that causes the server to read memory outside of allocated buffers.

Exploitation of this vulnerability can lead to information disclosure or a denial-of-service condition if the process crashes. With a CVSS score of 8.2, the risk is significant for organizations relying on coturn for real-time communication services, as memory leaks could expose sensitive data handled during session establishment.

Immediate Action: Update the coturn server installation to version 4.15.0 or later.

Proactive Monitoring: Monitor server performance and process logs for frequent restarts or crashes, which may indicate attempted exploitation.

Compensating Controls: Deploy a Web Application Firewall or an Intrusion Prevention System capable of inspecting STUN/TURN traffic for malformed packets or suspicious length fields.

Public Exploit Available: Unknown.

Security teams should prioritize updating all coturn instances to version 4.15.0 to mitigate the risk of memory-based attacks. Proactive patching is essential to ensure the continued integrity and availability of your TURN/STUN communication infrastructure.