Log in Start free

Vulnerability · Published Feb 10, 2026 · Assigned by GitHub_M

CVE-2026-25506MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery

High 7.7

In plain English

A high-severity out-of-bounds write in munge from dun. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.7High
Exploit odds (30 days)0.3%top 72.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

MUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer overflow vulnerability in munged (the MUNGE authentication daemon) to leak cryptographic key material from process memory. With the leaked key material, the attacker could forge arbitrary MUNGE credentials to impersonate any user (including root) to services that rely on MUNGE for authentication. The vulnerability allows a buffer overflow by sending a crafted message with an oversized address length field, corrupting munged's internal state and enabling extraction of the MAC subkey used for credential verification. This vulnerability is fixed in 0.5.18.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10munge0.5.15-11.el10_1ALSA-2026:3033
AlmaLinux:8munge0.5.13-3.el8_10ALSA-2026:3032
AlmaLinux:9munge0.5.13-14.el9_7ALSA-2026:3034
AlmaLinux:10munge-devel0.5.15-11.el10_1ALSA-2026:3033
AlmaLinux:8munge-devel0.5.13-3.el8_10ALSA-2026:3032
AlmaLinux:9munge-devel0.5.13-14.el9_7ALSA-2026:3034
AlmaLinux:10munge-libs0.5.15-11.el10_1ALSA-2026:3033
AlmaLinux:8munge-libs0.5.13-3.el8_10ALSA-2026:3032
AlmaLinux:9munge-libs0.5.13-14.el9_7ALSA-2026:3034
Debian:12munge0.5.15-2+deb12u1DEBIAN-CVE-2026-25506
Debian:12munge0.5.15-2+deb12u1DSA-6129-1
Debian:13munge0.5.16-1.1~deb13u1DSA-6129-1
Debian:13munge0.5.16-1.1~deb13u1DEBIAN-CVE-2026-25506
Debian:14munge0.5.16-1.1DEBIAN-CVE-2026-25506
Rocky Linux:10munge0:0.5.15-11.el10_1RLSA-2026:3033
Rocky Linux:8munge0:0.5.13-3.el8_10RLSA-2026:3032
Rocky Linux:9munge0:0.5.13-14.el9_7RLSA-2026:3034
Ubuntu:22.04:LTSmunge0.5.14-6ubuntu0.1USN-8040-1
Ubuntu:22.04:LTSmunge0.5.14-6ubuntu0.1UBUNTU-CVE-2026-25506
Ubuntu:24.04:LTSmunge0.5.15-4ubuntu0.1USN-8040-1
Ubuntu:24.04:LTSmunge0.5.15-4ubuntu0.1UBUNTU-CVE-2026-25506
Ubuntu:25.10munge0.5.16-1ubuntu0.1USN-8040-1
Ubuntu:25.10munge0.5.16-1ubuntu0.1UBUNTU-CVE-2026-25506

Affected products (as reported)

VendorProductVersions
dun munge >= 0.5, < 0.5.18

Weakness: CWE-787, CWE-120 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

References