CVE-2026-81665: Heap-based Buffer Overflow in Red Hat Red Hat Enterprise Linux 10

This vulnerability involves a heap-based buffer overflow in Corosync's totempg message reassembly buffer, which lacks runtime bounds checking during fragmented multicast message processing. The flaw allows a network-adjacent attacker to send specially crafted multicast messages to cause heap corruption, leading to a crash of the Corosync daemon and denial of service for the cluster. The vulnerability has a CVSS 3.1 score of 7.5 (High) with attack vector network-adjacent, high impact on confidentiality, integrity, and availability. Red Hat has released an update for Corosync in Red Hat Enterprise Linux 10 Extended Update Support to fix this issue.

Successful exploitation can cause the Corosync daemon to crash, resulting in denial of service to the entire cluster. The vulnerability also has the potential for further exploitation due to heap corruption, which could impact confidentiality, integrity, and availability of the cluster services.

Red Hat has released a security update for Corosync in Red Hat Enterprise Linux 10 Extended Update Support that addresses this heap-based buffer overflow. Users should apply the update as detailed in the Red Hat advisory (RHSA-2026:67881) and the referenced update article (https://access.redhat.com/articles/11258). No additional mitigation steps are indicated by the vendor advisory.