Heap-Based Buffer Overflow in Corosync's Totem Process Group
CVE-2026-81665
Key Information:
- Vendor
Red Hat
- Status
- Vendor
- CVE Published:
- 4 September 2026
What is CVE-2026-81665?
A heap-based buffer overflow has been identified in Corosync's Totem Process Group, affecting its ability to properly handle fragmented multicast messages. The vulnerability arises from the lack of a runtime bounds check in the buffer used during the reassembly of message fragments. A potential network adversary can exploit this by sending specially crafted multicast protocol messages to the Corosync cluster, leading to a heap buffer overflow that can crash the Corosync daemon. This incident not only disrupts service to the entire cluster but also opens the door for possible further exploitation through heap corruption.
Affected Version(s)
Red Hat Enterprise Linux 10 0:3.1.10-1.el10_2.2
Red Hat Enterprise Linux 10.0 Extended Update Support 0:3.1.9-1.el10_0.3
Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:2.4.5-7.el7_9.4
References
CVSS V3.1
Timeline
Vulnerability published
Vulnerability Reserved