The vulnerability CVE-2026-10649 affects the Pacemaker component in Red Hat Enterprise Linux 8 and 9. It involves an integer overflow or wraparound in the remote message decompression process. An unauthenticated remote attacker can send a specially crafted compressed message prior to authentication, triggering memory corruption that leads to a denial of service by crashing the CIB remote listener service. The flaw is tracked as CWE-190 (Integer Overflow or Wraparound). Red Hat has issued security advisories RHSA-2026:39322 and RHSA-2026:39323 providing patches for affected versions.

Successful exploitation allows an unauthenticated remote attacker to cause memory corruption and crash the CIB remote listener service, resulting in denial of service. The impact is limited to service availability disruption without direct confidentiality or integrity compromise according to the CVSS vector (Confidentiality: Low, Integrity: Low, Availability: High). No known exploits in the wild have been reported at this time.

Red Hat has released official security updates that fix this vulnerability. Users should apply the pacemaker package updates provided in advisories RHSA-2026:39322 for Red Hat Enterprise Linux 8 and RHSA-2026:39323 for Red Hat Enterprise Linux 9. Detailed update instructions are available at https://access.redhat.com/articles/11258. Applying these updates will remediate the integer overflow vulnerability and prevent exploitation. No additional mitigations are required beyond applying the official patches.