Log in Start free

Vulnerability · Published Sep 4, 2026 · Assigned by redhat

CVE-2026-81666Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems

Medium 6.5

In plain English

A medium-severity integer overflow in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.2%top 84.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an out-of-bounds memory access that crashes the Corosync daemon. This results in a denial of service for the affected cluster node. The overflow does not occur on 64-bit systems, where the length calculation is correctly performed in 64-bit arithmetic.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12corosyncno fix listedDEBIAN-CVE-2026-81666
Debian:13corosyncno fix listedDEBIAN-CVE-2026-81666
Debian:14corosyncno fix listedDEBIAN-CVE-2026-81666
Ubuntu:22.04:LTScorosyncno fix listedUBUNTU-CVE-2026-81666
Ubuntu:24.04:LTScorosyncno fix listedUBUNTU-CVE-2026-81666
Ubuntu:26.04:LTScorosyncno fix listedUBUNTU-CVE-2026-81666
Ubuntu:26.10corosyncno fix listedUBUNTU-CVE-2026-81666

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Container Platform 5 see references

Weakness: CWE-190 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References