CVE-2026-25506: MUNGE 0.5-0.5.17 buffer overflow allowing key leakage

[Chris Dunlap <chris.m.dunlap () gmail com>]

A buffer overflow vulnerability in MUNGE allows a local attacker to leak 
cryptographic key material from the munged daemon process memory. With 
the leaked key material, the attacker could forge arbitrary MUNGE 
credentials to impersonate any user to services that rely on MUNGE for 
authentication.

The vulnerability allows a buffer overflow by sending a crafted message 
with an oversized address length field, corrupting munged's internal 
state and enabling extraction of the MAC subkey used for credential 
verification.

In HPC environments where workload managers and other services use MUNGE 
for authentication, forged credentials could potentially enable 
privilege escalation.

There is no indication this vulnerability is being exploited in the 
wild. The vulnerability was discovered during a security audit and 
responsibly disclosed.

CVE-2026-25506
Severity: High (CVSS 7.7)
Attack Vector: Local
Affected: MUNGE 0.5 through 0.5.17
Fixed: MUNGE 0.5.18

Release: https://github.com/dun/munge/releases/tag/munge-0.5.18
Advisory: 
https://github.com/dun/munge/security/advisories/GHSA-r9cr-jf4v-75gh

Users should upgrade to MUNGE 0.5.18 or apply vendor-supported updates 
that include fixes for CVE-2026-25506. Sites should schedule appropriate 
maintenance windows to regenerate MUNGE keys after patching. See the 
advisory for complete mitigation guidance.

Reported by Titouan Lazard (LEXFO).

Chris Dunlap
MUNGE Maintainer
PGP: A441 880C 3D4C 7C36 C5DD 41E1 3B7E CB2B 30DE 0871
Key: https://github.com/dun.gpg

Attachment: OpenPGP_0x3B7ECB2B30DE0871.asc
Description: OpenPGP public key

Attachment: OpenPGP_signature.asc
Description: OpenPGP digital signature