The vulnerability is a format string injection that occurs when an authenticated TURN user sends printf‑style specifiers in the STUN USERNAME or REALM attributes. These values are validated as secure strings but are later injected directly into redis keys used by hiredis. The format string is passed to redisAsyncCommand() with only one argument, causing hiredis’ redisvFormatCommand() to read past the va_list. This can crash the coturn process, terminate active TURN sessions, or leak stack memory into Redis if the attacker can observe the key contents.

Affected products include all versions of the coturn TURN/STUN server released before 4.13.0. The vulnerability applies to the coturn product as distributed by the coturn vendor. Clients connecting to a coturn instance with authenticated TURN credentials and supplying malicious USERNAME or REALM fields are able to trigger the flaw.

The CVSS score of 7.1 indicates a high severity. No EPSS score is available, so the exploitation probability cannot be quantified, and the vulnerability is not listed in CISA KEV. The flaw is exploitable from any authenticated client that can send a TURN binding request, so the attack vector is within the protected network. A successful exploit can cause a denial of service or potentially disclose sensitive stack data to an attacker who can read the rogue redis key.