A remote unauthenticated attacker can trigger Corosync to perform an out‑of‑bounds read by sending a specially crafted User Datagram Protocol packet that exploits a wrong return value in the membership commit token sanity check. The resulting memory read can cause the Corosync service to crash, delivering a denial of service, and can expose a small portion of in‑memory data, which may contain sensitive information. The vulnerability is a classic example of an invalid function return value weakness, classified as CWE‑253.

The flaw affects Corosync deployments that use the default totemudp/totemudpu transport, which is shipped with Red Hat Enterprise Linux 7, 8, 9, 10 and Red Hat OpenShift Container Platform 4. No specific version numbers are provided, so all standard builds that rely on the default UDP transport are potentially impacted.

The CVSS score of 8.2 indicates high severity, while an EPSS score of less than 1 % suggests a low probability of exploitation. The vulnerability is remotely exploitable over the network via UDP traffic directed at Corosync’s communication channel—though the precise port is not disclosed, the typical Corosync UDP endpoint is implied. Because no widespread exploitation has been reported and the vulnerability is not listed in the CISA KEV catalog, the current exposure risk is moderate, but the potential impact of a service crash or memory leakage warrants immediate countermeasures.