Read the docs
TI-2026-85168 Aliases CVE-2026-122126GHSA-32v3-8rp4-cq83

Heap buffer overflow in reSIProcate reTurn client via TurnTcpSocket

Priority LOW 36CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.

Summary

reSIProcate reTurn client through 1.14.0 contains a heap buffer overflow (CWE-122) in TurnTcpSocket::handleReadHeader(). Oversized frame lengths let a malicious TURN server or an on-path attacker overwrite heap memory. Attackers can send STUN or ChannelData frames declaring up to 65535 bytes, which writes about 57 KB past an 8192-byte buffer and crashes the client. Only the synchronous TCP and TLS client is affected, not the asynchronous client or the reTurn server.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

reSIProcate reTurn client through 1.14.0 contains a heap buffer overflow in TurnTcpSocket::handleReadHeader(), which TurnTlsSocket inherits, that allows malicious TURN servers or on-path attackers to overwrite memory via oversized frame lengths. Attackers can send STUN or ChannelData frames declaring up to 65535 bytes, writing roughly 57 KB past the fixed 8192-byte mReadBuffer and crashing the client. Only the synchronous TCP and TLS client is affected; the asynchronous client (TurnAsyncSocket) and the reTurn server are not.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00369 30th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
resiprocateresiprocateup to 1.14.0—No fix listedCNA
  • resiprocate Vendorresiprocate Affected up to 1.14.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for resiprocate.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-122126
  2. 2026-11-04 Alias added: GHSA-32v3-8rp4-cq83
  3. 2026-11-05 CISA SSVC decision points changed
  4. 2026-11-05 Priority changed: MEDIUM → LOW
  5. 2026-11-06 Affected versions changed · Red Hat
  6. 2026-11-06 CVSS score added · Red Hat

References

Patch 2

Other 2

  • TI-2018-09033 The ConnectionBase::preparseNewBytes function in resip/stack/ConnectionBase.cxx in… CVSS 3.1CRITICAL 9.8
  • TI-2017-08518 The SdpContents::Session::Medium::parse function in resip/stack/SdpContents.cxx in… CVSS 3.1HIGH 7.5
  • TI-2017-06865 Buffer overflow in the ares_parse_a_reply function in the embedded ares library in… CVSS 3.1HIGH 7.5
  • TI-2008-03061 Multiple unspecified vulnerabilities in ReSIProcate before 1.3.4 allow remote attackers… CVSS 2.0HIGH 7.8
  • TI-2008-03072 rutil/dns/DnsStub.cxx in ReSIProcate 1.3.2, as used by repro, allows remote attackers to… CVSS 2.0MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences