{"id":"CVE-2026-81665","title":"A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly","summary":"A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds.…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-122"],"vendor":"Red Hat","product":"corosync","affected":["corosync (all versions)","corosync (all versions)","corosync (all versions)","corosync (all versions)","corosync (all versions)","corosync (all versions)","corosync (all versions)","corosync (all versions)","corosync (all versions)","corosync (all versions)","openshift/ose-rhel-coreos-9 (all versions)","rhcos (all versions)"],"patched":["enterprise_linux_appstream_eus_v_10_0","enterprise_linux_appstream_v_10","enterprise_linux_appstream_e4s_v_9_4","enterprise_linux_appstream_eus_v_9_6","enterprise_linux_appstream_v_9","enterprise_linux_codeready_linux_builder_eus_v_10_0","enterprise_linux_codeready_linux_builder_v_10","codeready_linux_builder_eus_v_9_6","enterprise_linux_codeready_linux_builder_v_9","enterprise_linux_high_availability_eus_v_10_0","enterprise_linux_high_availability_v_10","enterprise_linux_high_availability_e4s_v_9_4","enterprise_linux_high_availability_eus_v_9_6","enterprise_linux_high_availability_v_9","enterprise_linux_resilient_storage_e4s_v_9_4","enterprise_linux_resilient_storage_eus_v_9_6","enterprise_linux_resilient_storage_v_9"],"published":"2026-09-04","updated":"2026-09-21","sourceUpdated":"2026-09-21T17:19:03.657","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-81665","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:67872","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:67873","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:67878","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:67879","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:67880","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:67881","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:68574","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:69277","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:69278","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:69279","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:69280","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-81665","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524910","label":"secalert@redhat.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-81665.json"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81665"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81665"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00349,"epssPercentile":0.25688,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-04T17:09:13.395902Z"},"ingestedAt":"2026-09-08T20:10:03.163Z","slug":"CVE-2026-81665","body":"## Overview\n\nA heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast protocol messages to the cluster could cause a heap buffer overflow with attacker-controlled data. This can crash the Corosync daemon, causing a denial of service to the entire cluster, and may potentially allow further exploitation given sufficient heap-corruption control.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:67881** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux High Availability EUS (v. 10.0) · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:67881)\n- **RHSA-2026:67872** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux High Availability (v. 10) · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:67872)\n- **RHSA-2026:67878** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux High Availability E4S (v.9.4), Red Hat Enterprise Linux Resilient Storage E4S (v.9.4) · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:67878)\n- **RHSA-2026:67879** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux High Availability EUS (v.9.6), Red Hat Enterprise Linux Resilient Storage EUS (v.9.6) · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:67879)\n- **RHSA-2026:67873** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux High Availability (v. 9), Red Hat Enterprise Linux Resilient Storage (v. 9) · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:67873)\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-81665.json)\n- **RHSA-2026:68574** · Red Hat · fixed in: Red Hat Enterprise Linux Server HighAvailability (v. 7 ELS), Red Hat Enterprise Linux Server ResilientStorage (v. 7 ELS) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68574)\n- **RHSA-2026:67880** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux High Availability E4S (v.9.2), Red Hat Enterprise Linux Resilient Storage E4S (v.9.2) · released 2026-09-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:67880)\n- **RHSA-2026:69278** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8), Red Hat Enterprise Linux High Availability E4S (v.8.8), Red Hat Enterprise Linux High Availability TUS (v.8.8) · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69278)\n- **RHSA-2026:69277** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8), Red Hat Enterprise Linux HighAvailability (v. 8), Red Hat Enterprise Linux ResilientStorage (v. 8) · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69277)\n- **RHSA-2026:69280** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4), Red Hat Enterprise Linux High Availability AUS (v.8.4), Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4), Red Hat Enterprise Linux ResilientStorage EUS EXTENSION (v.8.4) · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69280)\n- **RHSA-2026:69279** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6), Red Hat Enterprise Linux High Availability EUS EXTENSION (v.8.6), Red Hat Enterprise Linux Resilient Storage EUS EXTENSION (v.8.6) · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69279)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}