The vulnerability is a heap‑based buffer overflow in Corosync’s Totem Process Group reassembly routine when handling fragmented multicast messages. An attacker with network proximity can craft malformed multicast packets that overflow the reassembly buffer, causing the Corosync daemon to crash. The crash disables the entire cluster, providing a denial of service. Because the overflow corrupts heap data, an experienced adversary might achieve further exploitation if additional heap corruption control is available.

Red Hat Enterprise Linux 7, 8, 9 and 10, and Red Hat OpenShift Container Platform 4 are affected. No specific patch release versions are listed in the CNA data.

The CVSS score is 7.5 and the vulnerability is not currently listed in CISA KEV; EPSS data is not available. The likely attack vector is a network‑adjacent attacker able to send malicious multicast packets to the cluster, which is how the overflow is triggered. All exploitable conditions rely on sending crafted network traffic to the cluster nodes and are therefore mitigable through network controls, authentication, and patching if a fix becomes available.