What is the CVSS score of CVE-2026-81665?

CVE-2026-81665 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-81665?

Within 24 hours, identify all production Corosync deployments and restrict cluster network connectivity to only known, authorized nodes through firewall or network segmentation. Within 7 days, implement dedicated network isolation for cluster heartbeat traffic, document the current Corosync versions in use, and subscribe to the Corosync project security advisory channels. Within 30 days, prepare and pre-test an upgrade procedure so patches can be deployed rapidly upon release, configure enhanced logging on cluster processes to detect exploitation attempts, and review failover and backup procedures to minimize service impact if a cluster outage occurs.

Corosync CVE-2026-81665

EUVD-2026-70978 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-09-04 redhat

GHSA-vj89-2c25-485x

Buffer Overflow Denial Of Service Heap Overflow Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Openshift Container Platform 4 Red Hat

7.5

CVSS 3.1 · Vendor: redhat

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Gain adjacency to cluster multicast network
Delivery

craft fragmented Totem protocol multicast messages
Exploit

send crafted fragments to cluster nodes
Execution

trigger reassembly buffer overflow in totempg
Persist

corrupt Corosync daemon heap
Impact

daemon crash causes cluster-wide DoS

Vulnerability Assessment

Weakness	CWE CWE-122 ASVS 5.0 V15 - Secure Coding and Architecture Heap buffer bounds checking MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	The attacker must be network-adjacent - specifically able to send IP multicast packets to the Corosync cluster's heartbeat multicast group (default 226.94.1.1, UDP port 5405) and receive responses. This requires L2 adjacency or multicast routing to the cluster's dedicated HA network. No authentication is required (PR:N). The vulnerability is present in release builds of Corosync as shipped by Red Hat; debug builds with bounds-checking assertions may not be vulnerable. The cluster must be actively processing fragmented Totem messages. Exploitation is limited by AC:H - crafting a payload that triggers the specific overflow condition and controlling heap layout for potential code execution requires attacker expertise and knowledge of the Corosync memory allocator state.
Impact	The provided CVSS vector (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, score 7.5) correctly reflects network-adjacent access and high complexity, but the C:H and I:H metrics appear aspirational - the description's language ('may potentially allow further exploitation') indicates DoS is the confirmed outcome and RCE is speculative. A more conservative independent assessment yields C:N/I:N/A:H. The AC:H rating is appropriate: exploiting a heap overflow to achieve predictable code execution requires careful heap-layout manipulation, making reliable RCE significantly harder than the DoS primitive. The AV:A constraint is a meaningful real-world limiter - an attacker must be on the same Layer-2 multicast domain as the Corosync cluster nodes, which in most deployments is a dedicated, firewalled HA heartbeat network. No EPSS data was provided; no KEV listing and no POC exist, making active exploitation unlikely in the near term. For clusters where the heartbeat network is co-located with untrusted segments or accessible to virtual machines, risk is substantially elevated. For properly segmented HA clusters, exploitation opportunity is limited.
Exploit ScenarioDerived	An attacker with access to the cluster's multicast network segment - for example, a compromised virtual machine sharing the same L2 segment as cluster heartbeat interfaces - crafts a sequence of fragmented Totem protocol multicast messages whose reassembled payload exceeds the reassembly buffer bounds. Sending these packets causes heap corruption in the Corosync daemon process, immediately crashing it and triggering a full cluster quorum loss and service failover cascade. With precise heap control, a sophisticated attacker might attempt to redirect execution, though no proof-of-concept demonstrating this has been identified.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 04, 2026

Heap buffer overflow in Corosync's Totem Process Group (totempg) message reassembly exposes high-availability clusters to network-adjacent unauthenticated attack. When processing fragmented multicast messages, the reassembly buffer lacks runtime bounds checking in release builds, allowing an attacker on the same cluster network to trigger heap corruption with attacker-controlled data. The confirmed impact is a daemon crash causing full cluster denial-of-service; the description explicitly acknowledges the potential for further exploitation - including possible code execution - contingent on heap layout control, though RCE remains unconfirmed at time of analysis. No public exploit or KEV listing identified.

RemediationAI

Apply the Red Hat-issued errata for Corosync when published for the applicable RHEL or OpenShift release stream; monitor https://access.redhat.com/security/cve/CVE-2026-81665 for patch availability. No specific fixed version was confirmed in the provided data. Until a patch is available, the most effective compensating control is strict network segmentation: restrict multicast traffic on the Corosync heartbeat network (typically UDP multicast on port 5405) to only the IP addresses of legitimate cluster nodes using host-based firewall rules (firewalld zone isolation or iptables) and switch-level VLAN segregation. This eliminates the AV:A attack surface entirely for external threats. If ring redundancy allows it, disabling multicast in favor of unicast configuration reduces the multicast attack surface, though this changes cluster communication behavior and should be validated in a lab environment first. On RHEL, running Corosync under a seccomp or SELinux policy that limits heap execution can raise the bar for RCE exploitation while having no effect on the DoS risk.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Corosync is an open-source cluster membership and messaging layer, widely deployed alongside Pacemaker in Linux high-availability environments. Its Totem Single Ring Order and Membership (TORUM) protocol, implemented via the totempg subsystem, uses IP multicast for intra-cluster communication. CWE-122 (Heap-based Buffer Overflow) identifies the root cause: when reassembling fragmented multicast messages, the destination buffer does not perform runtime length validation, and this check is absent specifically in release builds (suggesting a debug-only guard or assertion that is compiled out). CPE data confirms the vulnerable package is shipped across Red Hat Enterprise Linux 7, 8, 9, and 10, as well as Red Hat OpenShift Container Platform 4, which relies on Corosync for cluster quorum.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.5 HIGH

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 5.3 MEDIUM

Confirmed impact is daemon crash (DoS); RCE is speculative, so C and I are N; AV:A and AC:H accurately reflect multicast adjacency and heap-exploitation complexity.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE HIGH

Red Hat 7.5 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast protocol messages to the cluster could cause a heap buffer overflow with attacker-controlled data. This can crash the Corosync daemon, causing a denial of service to the entire cluster, and may potentially allow further exploitation given sufficient heap-corruption control.

Executive ViewAI

Why It Matters

Corosync-based high-availability infrastructure faces operational risk from a network-based vulnerability that can disable entire cluster systems, disrupting all dependent applications and services. Organizations must implement network isolation immediately to prevent cluster-wide outages until vendor remediation is available.

Business Impact: High

Compensating Controls

Restrict cluster multicast and network access to authorized cluster nodes only via firewall or network policies; implement network-level rate limiting on cluster communication ports; enable comprehensive audit logging and real-time alerting on Corosync daemon activity for unusual message patterns; maintain current backups and regularly test failover procedures to minimize impact if cluster compromise occurs.

Threat Intelligence Overview

EPSS Score

0.2%

Top 89% exploitable

Prevalence

Medium

standard HA clustering layer on enterprise RHEL deployments

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Controlled

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*

cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*

cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*

cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all

CVE-2026-18663 MEDIUM This Month

5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash

CVE-2026-4631 CRITICAL Act Now POC

9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h

CVE-2026-4480 CRITICAL Act Now POC

9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft

CVE-2026-101258 HIGH This Week POC

7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript

CVE-2026-96889 HIGH This Week POC

7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity

CVE-2026-4775 HIGH This Week POC

7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM This Month POC

6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe

CVE-2026-18922 CRITICAL Act Now

9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo

CVE-2026-14544 CRITICAL Act Now

9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL Act Now

9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a

CVE-2026-102560 CRITICAL Act Now

9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes

CVE-2026-5121 HIGH Act Now

7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-122 – Heap-based Buffer Overflow

View all

CVE-2023-4911 HIGH POC

7.8

CVE-2023-27997 CRITICAL

9.8

CVE-2026-94127 CRITICAL POC

9.3

CVE-2025-25249 CRITICAL POC

9.8

CVE-2026-85880 HIGH POC

7.8

CVE-2025-24985 HIGH POC

7.8

CVE-2026-53362 HIGH POC

7.8

CVE-2025-21418 HIGH

7.8

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP4	Affected
SUSE Linux Enterprise High Availability Extension 15 SP5	Affected
SUSE Linux Enterprise High Availability Extension 15 SP6	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back