CVE-2026-25506 describes a buffer overflow vulnerability (CWE-787) in the munged daemon of MUNGE authentication service versions 0.5 through 0.5.17. A local attacker can exploit this by sending a crafted message with an oversized address length field, causing an out-of-bounds write that corrupts internal state and leaks the MAC subkey used for credential verification. This key leakage enables forging of arbitrary credentials, allowing impersonation of any user, including root, to services relying on MUNGE. The issue is resolved in version 0.5.18. The CVSS v3.1 base score is 7.7 (High), reflecting local attack vector with high impact on confidentiality and integrity, and low impact on availability.

Successful exploitation allows a local attacker to leak cryptographic key material from the munged process memory, enabling forging of arbitrary MUNGE credentials. This can lead to impersonation of any user, including root, to services that rely on MUNGE for authentication, compromising system security and trust boundaries.

An official fix is available in MUNGE version 0.5.18. Users should upgrade affected versions (>=0.5 <0.5.18) to 0.5.18 or later to remediate this vulnerability. Refer to the Red Hat advisory RHSA-2026:2954 for update instructions. No alternative mitigations are indicated by the vendor advisory.