Coturn’s STUN/TURN attribute parsing performs unsafe pointer casts (CWE‑704), allowing a crafted UDP packet with odd‑aligned attributes to trigger a misaligned memory read on ARM64. The resulting SIGBUS kills the turnserver process, causing a denial of service to all clients. The flaw is exploitable by an unauthenticated remote attacker and requires no authentication or privileged input.

The vulnerability affects coturn servers running any version prior to 4.10.0 on ARM64 (AArch64) hardware. All coturn installations exposing the default TURN/STUN port are at risk when deployed on this architecture.

The CVSS score of 7.5 indicates moderate‑to‑severe risk. No exploitation probability score has been published, and the vulnerability is not listed in the CISA KEV catalog, but the very small attack surface and the single‑packet requirement suggest a high likelihood of exploitation in targeted deployments, based on inference from the description. Because the attack originates from a raw UDP packet, it can be carried out remotely without authentication, making quick service disruption possible.