[oss-security] CVE-2026-25506: MUNGE 0.5-0.5.17 buffer overflow allowing key leakage

[Chris Dunlap]

A buffer overflow vulnerability in MUNGE allows a local attacker to leak cryptographic key material from the munged daemon process memory. With the leaked key material, the attacker could forge arbitrary MUNGE credentials to impersonate any user to services that rely on MUNGE for authentication.

CVE-2026-25506
Severity: High (CVSS 7.7)
Attack Vector: Local
Affected: MUNGE 0.5 through 0.5.17
Fixed: MUNGE 0.5.18

Release: https://github.com/dun/munge/releases/tag/munge-0.5.18

The vulnerability allows a buffer overflow by sending a crafted message with an oversized address length field, corrupting munged's internal state and enabling extraction of the MAC subkey used for credential verification. In HPC environments where workload managers and other services use MUNGE for authentication, forged credentials could potentially enable privilege escalation. There is no indication this vulnerability is being exploited in the wild. The vulnerability was discovered during a security audit and responsibly disclosed. Advisory: https://github.com/dun/munge/security/advisories/GHSA-r9cr-jf4v-75gh

Reported by Titouan Lazard (LEXFO).

Chris Dunlap
MUNGE Maintainer
PGP: A441 880C 3D4C 7C36 C5DD 41E1 3B7E CB2B 30DE 0871
Key: https://github.com/dun.gpg

Users should upgrade to MUNGE 0.5.18 or apply vendor-supported updates that include fixes for CVE-2026-25506. Sites should schedule appropriate maintenance windows to regenerate MUNGE keys after patching. See the advisory for complete mitigation guidance.

OpenPGP_0x3B7ECB2B30DE0871.asc
Description: OpenPGP public key

OpenPGP_signature.asc
Description: OpenPGP digital signature