CVE-2026-81665
Received Received - Intake

Heap Buffer Overflow in Corosync Totem Process Group

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: redhat-SADP

Description
A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast protocol messages to the cluster could cause a heap buffer overflow with attacker-controlled data. This can crash the Corosync daemon, causing a denial of service to the entire cluster, and may potentially allow further exploitation given sufficient heap-corruption control.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
2026-09-04
NVD
CVE-2026-81665
EUVD
EUVD-2026-70978

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
corosync corosync *
corosync corosync 3.1.10
corosync corosync From 3.1.10 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-81665 is a heap-based buffer overflow in Corosync's Totem Process Group message reassembly. When processing fragmented multicast messages, the buffer lacks runtime bounds checking in release builds. An attacker on the same network can send crafted messages to trigger a heap overflow with attacker-controlled data, crashing the Corosync daemon and causing a denial of service for the entire cluster. This may allow further exploitation if heap corruption can be controlled.

Detection Guidance

To detect this vulnerability, check if your Corosync service is running and if cluster message authentication is enabled. Use commands like 'systemctl status corosync' to verify the service status. Inspect configuration files such as /etc/corosync/corosync.conf for settings like crypto_hash and crypto_cipher. Monitor logs for crashes or errors in the Corosync daemon using 'journalctl -u corosync' or 'tail -f /var/log/messages'.

Impact Analysis

This vulnerability can crash the Corosync daemon, disrupting cluster operations and causing a denial of service. If heap corruption is controlled, it may allow further exploitation. Systems using Corosync in High Availability clusters are at risk, especially if cluster message authentication is disabled or misconfigured.

Compliance Impact

This vulnerability primarily impacts availability and integrity of cluster services, which could lead to service disruptions or unauthorized access. For GDPR, it may affect data processing integrity and availability requirements under Article 32. For HIPAA, it could compromise the integrity and availability of electronic protected health information if cluster services are used in healthcare environments.

Mitigation Strategies

Immediately enable cluster message authentication if not already active. Use 'pcs cluster auth' to enforce encryption. Restrict network access to cluster communication ports (default 5404-5405/TCP/UDP) via firewalls. Ensure SELinux is in enforcing mode. Apply vendor patches when available. Monitor for unusual network traffic targeting Corosync ports.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81665. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart