Coturn, an open-source TURN/STUN server, has a stack buffer overflow in the decode_oauth_token_gcm() routine. An attacker can supply an OAuth access token whose nonce_len field, read as a 16‑bit integer, controls the length passed to memcpy(). Because the code copies up to 65535 bytes into a fixed 256‑byte buffer without bounds checking, up to 735 bytes of attacker‑controlled data may overwrite adjacent stack memory. This corruption can include control‑flow information, potentially allowing remote code execution. The overflow occurs before the AES‑GCM authentication check, so the attacker does not need to know the OAuth key or produce a valid token.

The vulnerability affects vendors in the coturn:coturn package. All releases older than version 4.10.0 are vulnerable. Servers that have the --oauth mode enabled are susceptible; the mode is not enabled by default but is commonly recommended for secure TURN deployment.

The CVSS score of 8.1 indicates a high severity. No EPSS score is available, and it is not listed in CISA KEV. The flaw requires that the TURN server is running with --oauth enabled and that an attacker can send a crafted OAuth token. Because the vulnerability does not rely on an AES‑GCM signature, it can be triggered with a simple HTTP request. Successful exploitation depends on mitigations such as stack canaries, ASLR, and compiler hardening; if such protections are absent or ineffective, a crafted payload could hijack control flow and achieve remote code execution.