CVE-2026-10649: Pacemaker Integer Overflow RCE Denial of Service Vulnerability

Technical summary

CVE-2026-10649 is an integer overflow vulnerability in Pacemaker's remote message decompression handler. The flaw exists in the pre-authentication message processing pipeline, where compressed data is decompressed before credential validation. An attacker can craft a specially formatted compressed message that triggers an integer overflow during decompression, corrupting memory in the CIB (Cluster Information Base) remote listener process. This leads to process termination and denial of service. The vulnerability is classified as CWE-190 (Integer Overflow or Wraparound).

Business impact

Exploitation of this vulnerability disrupts cluster management capabilities. In production environments, Pacemaker manages resource failover and high-availability services; a crashed CIB listener impairs or prevents cluster state synchronization and resource orchestration. For organizations relying on Pacemaker for application availability, successful attacks could cause cascading service outages. The attack requires only network access—no credentials or user interaction—making it a persistent availability risk for exposed clusters.

Affected systems

Pacemaker systems exposed to untrusted networks are at risk. This includes clusters with remote messaging enabled and systems where the CIB remote listener listens on accessible network interfaces. Organizations should inventory Pacemaker deployments and confirm which versions are in use; vendor-specific product lists and patch applicability require consultation of the official Pacemaker security advisory.

Exploitability

This vulnerability has a low barrier to exploitation. The attack vector is network-based, requires no authentication or user interaction, and the complexity is low. An attacker needs only the ability to send a network packet to the CIB remote listener port. No specialized tools or extensive reconnaissance are required; a proof-of-concept could be relatively straightforward. However, the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating no widespread active exploitation has been reported to date.

Remediation

Remediation requires applying a vendor-supplied security patch. Immediately check the official Pacemaker security advisory for affected versions and available patches. Patch deployment should be prioritized given the high CVSS score (8.6) and ease of exploitation. Until patching is feasible, network segmentation and firewall rules limiting access to the CIB remote listener port can reduce exposure. Verify against the vendor advisory for specific version numbers and patch applicability to your deployment.

Patch guidance

Consult the Pacemaker project's official security advisory to identify which versions are vulnerable and which patches resolve the issue. Apply patches in a controlled manner, testing in non-production environments first to ensure cluster stability. Consider the timing and sequence of updates across cluster nodes to maintain high availability during the patching window. After patching, verify the CIB remote listener is functioning and cluster nodes are synchronized.

Detection guidance

Monitor for unexpected crashes or restarts of the CIB remote listener process (often named 'pacemaker' or 'cib'). Network-based detection can identify malformed compressed messages sent to the CIB remote listener port by looking for irregular decompression patterns or early connection terminations. Log analysis should capture any errors related to message decompression failures. Establish baseline metrics for listener uptime and alert on anomalous restarts that may indicate exploitation attempts.

Why prioritize this

This vulnerability merits immediate attention due to its combination of high CVSS score (8.6), network-accessible attack vector, lack of authentication requirement, and high availability impact. The simplicity of exploitation—an attacker needs only network access and no special privileges—means the window for undetected attacks is wide. While not yet in the KEV catalog, the technical characteristics suggest urgent patching is warranted.

Risk score, explained

The CVSS 3.1 score of 8.6 (HIGH) reflects the network attack vector, low complexity, no privilege or user interaction requirement, and high impact on availability. The scope is unchanged (local resources affected). The low confidentiality and integrity impacts reflect potential side-effects of memory corruption; the high availability impact reflects assured service disruption. This scoring appropriately prioritizes the denial of service threat.

Frequently asked questions