CVE-2026-25506

A buffer overflow vulnerability was discovered in the MUNGE authentication daemon (munged). In affected versions, a local attacker can potentially leak secret cryptographic key material from the daemon's memory by sending a specially crafted message with an oversized address field. With the leaked key, an attacker could forge authentication credentials to impersonate any user, potentially escalating privileges in systems that rely on MUNGE for identity verification.

An Important vulnerability was discovered in munged. A local attacker could sending a specially crafted message to leak cryptographic key material. This could enable them to forge MUNGE credentials and impersonate any user, including a system administrator. The impact of this vulnerability is less than Critical as it cannot be exploited remotely.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.