This vulnerability involves an integer overflow or wraparound in the remote message decompression process of Pacemaker on Red Hat Enterprise Linux 10. The flaw allows an unauthenticated remote attacker to send a maliciously crafted compressed message that triggers memory corruption. This leads to a denial of service condition by crashing the CIB remote listener, impacting the availability of the affected service. The CVSS 3.1 score is 8.6, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation results in memory corruption causing the CIB remote listener service to crash, leading to denial of service. There is limited impact on confidentiality and integrity, but availability is severely affected due to service disruption.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-10649 for current remediation guidance. No official fix or workaround is explicitly stated in the provided advisory content. Users should monitor the vendor advisory for updates and apply patches once available.