Corosync TotemPG Heap Overflow (CVE-2026-81665)
CVE-2026-81665 Published on September 4, 2026

Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly
A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast protocol messages to the cluster could cause a heap buffer overflow with attacker-controlled data. This can crash the Corosync daemon, causing a denial of service to the entire cluster, and may potentially allow further exploitation given sufficient heap-corruption control.

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Vulnerability Analysis

Attack Vector:
ADJACENT_NETWORK
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Timeline

Reported to Red Hat.

Made public. 12 days later.

Weakness Type

Heap-based Buffer Overflow

A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().


Products Associated with CVE-2026-81665

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Enterprise Linux (RHEL)
 
Red Hat Openshift
 
Red Hat Enterprise Linux Eus
 
Red Hat Rhel E4s
 
Red Hat Rhel Eus
 

Affected Versions

Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10.0 Extended Update Support: Red Hat Enterprise Linux 7 Extended Lifecycle Support: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions: Red Hat Enterprise Linux 9.6 Extended Update Support: Red Hat Enterprise Linux 8: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: