Heap Buffer Overflow in reSIProcate reTurn Client

Executive Summary

CVE-2026-122126 is a heap buffer overflow in the reSIProcate reTurn client (versions up to 1.14.0). It occurs in the TurnTcpSocket::handleReadHeader() function where malicious TURN servers can send oversized STUN or ChannelData frames. The function fails to validate frame lengths, allowing attackers to declare up to 65535 bytes. This causes roughly 57 KB of data to be written past the fixed 8192-byte mReadBuffer, leading to memory corruption and crashes.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes in reSIProcate reTurn client applications (versions <= 1.14.0) when processing TURN server responses. Check logs for heap buffer overflow errors or segmentation faults during TCP-based TURN communication. Use network traffic analysis tools like Wireshark to inspect STUN or ChannelData frames for unusually large payloads (>8192 bytes).

Commands to check affected versions: grep -r 'reTurn client' /path/to/application or dpkg -l | grep resiprocate. Monitor for crashes in TurnTcpSocket::handleReadHeader() during TURN protocol handling.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to crash the reTurn client by sending malformed TURN server responses. If exploited, it could cause denial-of-service conditions, disrupting services relying on the reTurn client. Remote code execution is unlikely but possible if memory corruption leads to arbitrary code execution in the client process.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt services handling sensitive data. A crash due to heap buffer overflow may lead to service unavailability, which could violate availability requirements under GDPR Article 32 and HIPAA Security Rule requirements for access control and integrity. However, the vulnerability does not directly expose or leak data, so confidentiality impacts are limited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade reSIProcate reTurn client to a patched version (post-1.14.0) that includes bounds checking in TurnTcpSocket::handleReadHeader(). If upgrading is not possible, restrict network access to trusted TURN servers only. Disable TCP-based TURN communication if UDP alternatives exist.

Apply the patch from Pull Request #496 or update to a version incorporating commit 5bb559f. Ensure all TURN clients and servers enforce frame size limits and validate input lengths before processing.

Useful 0 Not Useful 0