Local heap buffer overflow in MUNGE munged leading to key material disclosure and credential forgery
CVE-2026-25506 is a local heap-based buffer overflow in MUNGE’s authentication daemon (munged) affecting MUNGE versions 0.5 through 0.5.17. The flaw is in message unpacking logic (reported in _msg_unpack for MUNGE_MSG_DEC_RSP) where an attacker-controlled 8-bit address length field (addr_len) is used to copy data into a fixed-size IPv4 address field (struct in_addr, 4 bytes) without enforcing bounds. Setting addr_len to an oversized value (e.g., 0xff) overflows into adjacent members of the struct m_msg, corrupting internal state and heap pointers (e.g., leading to invalid frees in m_msg_destroy) and enabling exploitable heap corruption. Exploitation can be used to obtain an arbitrary read primitive and ultimately leak MUNGE cryptographic key material (MAC/HMAC subkey) from munged process memory, which then enables forging arbitrary MUNGE credentials to impersonate other users to MUNGE-reliant services. The issue is fixed in MUNGE 0.5.18.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A local vulnerability in Munge allowing leakage of the Munge secret key from memory, enabling forged credentials/tokens and impersonation (including root) in HPC cluster environments.
A long-standing heap/struct overflow in Munge’s message unpacking logic where an attacker-controlled addr_len (uint8_t) is used to copy into a fixed-size struct in_addr (4 bytes). This can corrupt adjacent fields in struct m_msg, leading to invalid frees/crashes and, with exploitation, memory disclosure sufficient to recover Munge secrets (e.g., HMAC/encryption keys) and forge cluster-wide authentication tokens.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.