Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-81666— Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems

Quick assessment

Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Corosync 处理成员资格提交令牌（membership commit token）消息时，发现存在一个整数溢出漏洞。在 32 位系统中，由于预期消息长度的计算发生整数溢出，这些消息的长度校验检查可能被绕过，使得经过特制的网络数据包能够触发越界内存访问，从而导致 Corosync 守护进程崩溃。这会导致受影响的集群节点发生拒绝服务（DoS）。该溢出问题不会出现在 64 位系统中，因为在 64 位系统上，长度计算是在 64 位算术下正确执行的。

CVSS 6.5 · Medium EPSS 0.27% · P19

Possible ATT&CK Techniques 1 AI

T1027 · Obfuscated Files or Information

Affected Version Matrix 5

VendorProduct Version RangeStatus
Red Hat Red Hat Enterprise Linux 10 any affected
Red Hat Red Hat Enterprise Linux 7 any affected
Red Hat Red Hat Enterprise Linux 8 any affected
Red Hat Red Hat Enterprise Linux 9 any affected
Red Hat Red Hat OpenShift Container Platform 4 any affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-81666

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems
Source: CVE Program / CVE List V5
Vulnerability Description
An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an out-of-bounds memory access that crashes the Corosync daemon. This results in a denial of service for the affected cluster node. The overflow does not occur on 64-bit systems, where the length calculation is correctly performed in 64-bit arithmetic.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat Enterprise Linux 10 - cpe:/o:redhat:enterprise_linux:10
Red Hat Red Hat Enterprise Linux 7 - cpe:/o:redhat:enterprise_linux:7
Red Hat Red Hat Enterprise Linux 8 - cpe:/o:redhat:enterprise_linux:8
Red Hat Red Hat Enterprise Linux 9 - cpe:/o:redhat:enterprise_linux:9
Red Hat Red Hat OpenShift Container Platform 4 - cpe:/a:redhat:openshift:4

II. Public POCs for CVE-2026-81666

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-81666

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-81666 (1)

Other References for CVE-2026-81666 (1)

Same Patch Batch · Red Hat · 2026-09-04 · 6 CVEs total

CVE-2026-85197 7.6 HIGH Libsoup: libsoup: heap use-after-free in libsoup http/2 client on_data_read() via goaway d
CVE-2026-81665 7.5 HIGH Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmente
CVE-2026-85769 6.5 MEDIUM Libtpms: libtpms: heap out-of-bounds read in tpm2 state unmarshalling via unchecked block_
CVE-2026-85534 5.9 MEDIUM Libsoup: libsoup: http/2 client crash in on_data_source_read_callback when settings initia
CVE-2026-76925 5.8 MEDIUM Flatpak: flatpak: toctou race condition allows symlink redirection

IV. Related Vulnerabilities

Same product: Red Hat Enterprise Linux 10
Same vendor: Red Hat
Same weakness: CWE-190

V. Comments for CVE-2026-81666

No comments yet

Leave a comment