CVE-2026-10649 describes an integer overflow vulnerability in Pacemaker's remote message decompression component. This flaw allows an unauthenticated remote attacker to cause memory corruption by sending a specially crafted compressed message before authentication. The resulting memory corruption leads to a denial of service condition by crashing the CIB remote listener service within Pacemaker. The vulnerability affects multiple Red Hat Enterprise Linux 8 variants including High Availability and Resilient Storage. Red Hat has issued a security advisory (RHSA-2026:39322) with an update that fixes this issue by correcting the integer overflow handling. The CVSS v3.1 base score is 8.6 (High), reflecting network attack vector, no privileges required, no user interaction, and high impact on availability with limited confidentiality and integrity impact.

Successful exploitation results in denial of service by crashing the Pacemaker CIB remote listener service due to memory corruption from an integer overflow. The attacker does not require authentication or privileges and can trigger this remotely over the network. Confidentiality and integrity impacts are limited, but availability is severely affected, potentially disrupting cluster resource management and high availability services.

Red Hat has released an official security update to fix this vulnerability. Users of affected Red Hat Enterprise Linux 8 variants, including High Availability and Resilient Storage, should apply the update as described in Red Hat advisory RHSA-2026:39322. Refer to https://access.redhat.com/articles/11258 for update instructions. No alternative mitigations or workarounds are specified in the advisory. Patch status is confirmed as fixed by Red Hat.