CVE-2026-81665: Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly
A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast protocol messages to the cluster could cause a heap buffer overflow with attacker-controlled data. This can crash the Corosync daemon, causing a denial of service to the entire cluster, and may potentially allow further exploitation given sufficient heap-corruption control.
Other sources
Corosync is a group communication system providing reliable ordered messaging and membership services, and is the communication layer underlying Pacemaker HA clusters (RHEL High Availability Add-On). In exec/totempg.c, the totempgdeliverfn function reassembles fragmented multicast messages into a fixed-size per-node assembly buffer (struct assembly, data[MESSAGESIZEMAX + KNETMAXPACKETSIZE], ~1.06 MB on normal builds, ~128 KB on small-memory-footprint builds). The only bounds check before the memcpy at line 663 is an assert() at line 662, which is compiled out in release builds (-DNDEBUG). assembly->index grows unboundedly at line 737 for each continuation fragment with no upper-bound check. After 17-18 fragments on normal builds (3 fragments on small-memory-footprint builds), the memcpy writes attacker-controlled data past the end of the heap buffer.
Verified via an ASan-instrumented standalone harness reproducing the exact buffer layout and memcpy/index logic: after 17 fragments of 65,481 bytes each, assembly->index reached 1,113,177 (buffer capacity 1,114,112); fragment 18 triggered a confirmed heap-buffer-overflow WRITE of 65,481 bytes, 64,546 bytes past the buffer end.
Present in corosync v3.1.10 (latest upstream release) and main HEAD (commit 65235a8); no upstream fix exists for this bug. Reported by Tristan Madani (Talence Security) via PSIRTSUPT-22352.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Corosync clusters that process fragmented multicast protocol messages are exposed, including Pacemaker HA clusters that use Corosync as their communication layer. An attacker must be network-adjacent to the cluster and able to send crafted multicast protocol messages.
Does exploitation require authentication or user interaction?
No privileges or user interaction are required according to the supplied vector. Exploitation has high attack complexity and depends on crafting fragmented multicast messages that cause the reassembly buffer index to exceed its fixed size.
What is the likely impact if exploitation succeeds?
The overflow can crash the Corosync daemon and cause denial of service across the entire cluster. Because the overflow contains attacker-controlled data, further exploitation may be possible if sufficient heap-corruption control is achieved.
Are release builds affected by the missing bounds check?
Yes. The relevant bounds check is implemented only as an assert() before memcpy in totempg_deliver_fn, and asserts are compiled out of release builds with -DNDEBUG.