CVE-2026-81666 Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems

Description

An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an out-of-bounds memory access that crashes the Corosync daemon. This results in a denial of service for the affected cluster node. The overflow does not occur on 64-bit systems, where the length calculation is correctly performed in 64-bit arithmetic.

Exploitable from the adjacent network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector

Adjacent network

Attack complexity

Low

Privileges required

None

Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected products and versions