A remote unauthenticated attacker can trigger Corosync to perform an out‑of‑bounds read by sending a specially crafted User Datagram Protocol packet that exploits a wrong return value in the Corosync membership commit token sanity check. This leads to a denial of service and potentially discloses limited in‑memory data. The flaw is a classic instance of an invalid function return value weakness, identified as CWE‑253.

The flaw affects Corosync deployments that use the default totemudp/totemudpu transport, which is shipped with Red Hat Enterprise Linux 7, 8, 9, 10 and Red Hat OpenShift Container Platform 4. No specific version numbers are provided, so all standard builds that rely on the default UDP transport are potentially impacted.

The CVSS score of 8.2 indicates high severity, while an EPSS score of less than 1 % suggests a low probability of exploitation. The vulnerability is remotely exploitable over the network via UDP traffic directed at Corosync’s communication channel—though the precise port is not disclosed, the typical Corosync UDP endpoint is implied. Because no widespread exploitation has been reported and the vulnerability is not listed in the CISA KEV catalog, the current exposure risk is moderate, but the potential impact of a service crash or memory leakage warrants immediate countermeasures.