This vulnerability in Pacemaker involves an integer overflow during the remote message decompression process. An attacker can exploit this by sending a crafted compressed message remotely without authentication, triggering memory corruption that results in denial of service by crashing the CIB remote listener. The flaw affects Red Hat Enterprise Linux versions 8 and 9 prior to the fixed releases. Red Hat has issued security advisories RHSA-2026:39322 and RHSA-2026:39323 providing updated packages that fix this issue.

Successful exploitation causes denial of service by crashing the Pacemaker CIB remote listener service, impacting cluster resource management and potentially affecting data integrity and application availability. The CVSS 3.1 base score is 8.6 (High), reflecting network attack vector, no privileges required, no user interaction, and high impact on availability with limited impact on confidentiality and integrity.

Red Hat has released official security updates for Red Hat Enterprise Linux 8 and 9 that fix this vulnerability. Users should apply the updated pacemaker packages as detailed in Red Hat advisories RHSA-2026:39322 and RHSA-2026:39323. Refer to https://access.redhat.com/articles/11258 for update instructions. No additional mitigations are required once the update is applied.