CVE-2026-81666: corosync Integer Overflow in check_mem_commit_token_sanity

Vulnerability Summary: CVE-2026-81666 Vulnerability Overview Vulnerability ID: CVE-2026-81666 Component: corosync Vulnerability Type: Integer Overflow Location: function Description: On 32-bit systems, computes . The variable is derived from the attacker-controllable field. When , this multiplication overflows on 32-bit architectures, causing to become a very small value, allowing a short (108-byte) crafted message to pass the length check. Subsequently, when iterates over , an out-of-bounds read/write occurs on a small buffer. Severity: Medium Status: NEW Reported: 2026-08-27 10:46 UTC (OSIBD Bzpmort) Fixed Version: Unspecified Platform: Linux Allocator: Product Security Scope of Impact Affected Versions: corosync v3.1.10 and main HEAD (confirmed via diff) Architecture: 32-bit systems Related Vulnerability: Belongs to the same class of vulnerabilities as CVE-2026-35692. The latter added a check in and explicitly changed the return type from to to correctly reject malformed messages. Verification Data: - On 64-bit architectures (x86_64, aarch64, C compiler): The -induced multiplication overflow does not occur with 64-bit arithmetic (with return type), and the check correctly rejects the malformed message. - In 32-bit architecture tests: is correctly calculated as 4,294,967,296 (required_len = 294,967,391, correctly rejected). - 64-bit messages: 64-bit builds correctly calculate 4,294,967,320 (required_len = 294,967,391, correctly rejected). - The check (from the CVE-2026-35692 fix), when applied here, also correctly rejects the input. Reporter: Tristan Madeni (Falence Security), reported via PR/TSUPP-22382. Remediation Refer to the fix for the related vulnerability CVE-2026-35692: 1. Add a check; 2. Explicitly change the return type to to avoid integer overflow on 32-bit systems; 3. Add an upper-bound validation for in to prevent multiplication overflow. This fix has been confirmed effective in corosync v3.1.10 and main HEAD (verified via diff). POC / Exploit Code No standalone POC code block is included on the page, but key values and verification data (see “Verification Data” in “Scope of Impact”) are provided, which can serve as the basis for constructing a POC: Trigger value: Crafted message length: 108 bytes calculation result on 64-bit: 4,294,967,296 / 4,294,967,320

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-81666: corosync Integer Overflow in check_mem_commit_token_sanity

More from this source