An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an out-of-bounds memory access that crashes the Corosync daemon. This results in a denial of service for the affected cluster node. The overflow does not occur on 64-bit systems, where the length calculation is correctly performed in 64-bit arithmetic.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21887-1 advisory.

    - CVE-2026-81665: heap-based buffer overflow in totempg assembly buffer during fragmented message     reassembly       (bsc#1278738).
    - CVE-2026-81666: integer overflow in check_memb_commit_token_sanity may bypass message length validation     on 32-bit       systems (bsc#1278739).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4202-1 advisory.

    - CVE-2026-81665: heap-based buffer overflow in totempg assembly buffer during fragmented message     reassembly       (bsc#1278738).
    - CVE-2026-81666: integer overflow in check_memb_commit_token_sanity may bypass message length validation     on 32-bit       systems (bsc#1278739).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ef5ca6ecf7 advisory.

    Fix CVE-2026-81666 and CVE-2026-81665

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c0427570d6 advisory.

    Fix CVE-2026-81666 and CVE-2026-81665

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e97124c200 advisory.

    Fix CVE-2026-81666 and CVE-2026-81665

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An integer overflow was found in Corosync's handling of membership commit token messages. The length-     validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the     calculation of the expected message length, allowing a crafted network packet to trigger an out-of-bounds     memory access that crashes the Corosync daemon. This results in a denial of service for the affected     cluster node. The overflow does not occur on 64-bit systems, where the length calculation is correctly     performed in 64-bit arithmetic. (CVE-2026-81666)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
350152	openSUSE 16 Security Update : corosync (openSUSE-SU-2026:21887-1)	Nessus	SuSE Local Security Checks	Local	high
346791	SUSE SLES15: corosync / corosync-qdevice / corosync-qnetd / corosync-testagents / etc (SUSE-SU-2026:4202-1)	Nessus	SuSE Local Security Checks	Local	high
344888	Fedora 45 : corosync (2026-ef5ca6ecf7)	Nessus	Fedora Local Security Checks	Local	high
344673	Fedora 43 : corosync (2026-c0427570d6)	Nessus	Fedora Local Security Checks	Local	high
343784	Fedora 44 : corosync (2026-e97124c200)	Nessus	Fedora Local Security Checks	Local	high
342806	Linux Distros Unpatched Vulnerability : CVE-2026-81666	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-81666

medium

Tenable Plugins

high

high

high

high

high

medium