CVE-2026-25506 is a buffer overflow vulnerability (CWE-787) in the munged daemon of MUNGE authentication service versions 0.5.0 through 0.5.17. The flaw arises from improper handling of message unpacking, where an attacker can send a crafted message with an oversized address length field, causing out-of-bounds write and corruption of internal state. This corruption enables extraction of the MAC subkey used for credential verification. With the leaked key, an attacker can forge MUNGE credentials to impersonate any user, including root, to services relying on MUNGE for authentication. The vulnerability has a CVSS 3.1 score of 7.7 (High severity), requiring local attacker privileges and high attack complexity. The issue is resolved in MUNGE version 0.5.18. Red Hat has issued multiple advisories and errata addressing this vulnerability for their supported distributions.

A local attacker with low privileges can exploit this vulnerability to leak sensitive cryptographic key material from the munged process memory. This leakage enables forging of arbitrary MUNGE credentials, allowing impersonation of any user, including root, to services that rely on MUNGE for authentication. This compromises confidentiality, integrity, and authentication mechanisms within affected environments. The vulnerability has a high impact on confidentiality and integrity, with limited impact on availability.

An official fix is available in MUNGE version 0.5.18. Users and administrators should upgrade affected MUNGE installations to version 0.5.18 or later to remediate this vulnerability. Red Hat has released security advisories and errata with updated packages for affected Red Hat Enterprise Linux versions. Applying these vendor-provided updates will mitigate the issue. Patch status is confirmed by vendor advisories. No additional mitigations are specified beyond applying the official update.