CVE-2025-30472: Corosync

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.

Affected products

• Corosync Corosync: up to and including 3.1.9

Published 2025-03-22. Last modified 2026-06-17.