reSIProcate reTurn client through 1.14.0 Heap Buffer Overflow via TurnTcpSocket
cve-program · CVE-2026-122126
PublishedreSIProcate reTurn client through 1.14.0 contains a heap buffer overflow in TurnTcpSocket::handleReadHeader(), which TurnTlsSocket inherits, that allows malicious TURN servers or on-path attackers to overwrite memory via oversized frame lengths. Attackers can send STUN or ChannelData frames declaring up to 65535 bytes, writing roughly 57 KB past the fixed 8192-byte mReadBuffer and crashing the client. Only the synchronous TCP and TLS client is affected; the asynchronous client (TurnAsyncSocket) and the reTurn server are not.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-122126 · CVE overview and exploitation status
cve-program · CVE-2026-122126
- https://github.com/resiprocate/resiprocate/pull/496
- https://github.com/resiprocate/resiprocate/commit/5bb559fd96298073cab369fdfa610f981fb01e95
- https://github.com/resiprocate/resiprocate
- https://github.com/resiprocate/resiprocate/blob/resiprocate-1.14.0/reTurn/client/TurnTcpSocket.cxx#L124-L147
- https://www.vulncheck.com/advisories/resiprocate-return-client-through-1.14.0-heap-buffer-overflow-via-turntcpsocket
Related changes
Linked by CVE identifier- reSIProcate reTurn client through 1.14.0 Heap Buffer Overflow via TurnTcpSocket · Advisory content revised · 5 Nov 2026
- reSIProcate reTurn client through 1.14.0 Heap Buffer Overflow via TurnTcpSocket · Newly collected advisory · 4 Nov 2026