CVE-2026-81666 in Corosync
Summary
by MITRE • 09/04/2026
An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an out-of-bounds memory access that crashes the Corosync daemon. This results in a denial of service for the affected cluster node. The overflow does not occur on 64-bit systems, where the length calculation is correctly performed in 64-bit arithmetic.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified within Corosync involves a critical integer overflow flaw located specifically in the processing logic for membership commit token messages. This component of the cluster infrastructure software is responsible for managing node participation and state transitions within a high-availability cluster environment. The root cause lies in how the application calculates the expected length of incoming network packets before validating them against actual data boundaries. On systems utilizing 32-bit architectures, the arithmetic operations used to determine this message size are susceptible to overflow conditions when specific input values are provided by an attacker. This mathematical error results in a significantly smaller calculated buffer size than what is actually required or present in the malicious payload, effectively bypassing standard length-validation checks that would normally prevent such oversized inputs from being processed further into memory allocation routines.
The operational consequence of this flaw is severe and immediate upon exploitation. Because the validation logic fails to detect the true magnitude of the crafted network packet due to the integer overflow, Corosync proceeds to allocate insufficient memory or attempt access based on incorrect boundary assumptions. This discrepancy leads directly to an out-of-bounds memory access event when the daemon attempts to read from or write to the buffer associated with the membership commit token. The immediate result is a segmentation fault or similar critical error that causes the Corosync process to terminate unexpectedly. Since Corosync serves as the heartbeat and communication backbone for cluster nodes, its abrupt termination results in an instant denial of service condition for the affected node. This disruption can lead to split-brain scenarios if not handled by higher-level failover mechanisms, or simply cause a loss of high availability depending on the specific cluster configuration and redundancy levels present at the time of the attack.
From a classification perspective, this vulnerability aligns with CWE-190, which defines integer overflow or wraparound errors that can lead to other vulnerabilities such as buffer overflows or out-of-bounds accesses. The exploitation vector is categorized under network-based attacks where an unauthenticated remote attacker can trigger the condition by sending specially crafted packets to the Corosync service port. In terms of tactical mapping within the MITRE ATT&CK framework, this activity corresponds to techniques involving resource exhaustion and denial of service, specifically leveraging application layer protocol vulnerabilities to disrupt critical infrastructure services. The attack does not require prior authentication or access credentials, making it a significant risk for any publicly accessible or network-exposed Corosync instances that do not implement strict ingress filtering rules.
Mitigation strategies must address both the immediate technical flaw and broader architectural defenses. For affected systems running on 32-bit operating environments, applying vendor-provided patches is essential to correct the integer arithmetic logic within the membership commit token handler. Organizations should verify their patch levels against official security advisories released by Corosync maintainers. In addition to software updates, network-level controls are highly recommended as a defense-in-depth measure. Implementing strict firewall rules or access control lists that restrict inbound traffic on Corosync ports to only known and trusted cluster node IP addresses can prevent external attackers from reaching the vulnerable code path even if the vulnerability remains unpatched for any reason. Furthermore, deploying intrusion detection systems capable of identifying anomalous packet sizes or malformed protocol structures in real-time provides an additional layer of protection against exploitation attempts targeting this specific integer overflow condition.