DNA View

High Severity Vulnerability

This vulnerability has been rated as High severity. Immediate action is recommended.

CVE-2026-25506

High

Low Medium High Critical

7.7

CVSS Score

Published: Feb 10, 2026

Last Modified: Feb 25, 2026

CWE: CWE-787

Vulnerability Description

MUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer overflow vulnerability in munged (the MUNGE authentication daemon) to leak cryptographic key material from process memory. With the leaked key material, the attacker could forge arbitrary MUNGE credentials to impersonate any user (including root) to services that rely on MUNGE for authentication. The vulnerability allows a buffer overflow by sending a crafted message with an oversized address length field, corrupting munged's internal state and enabling extraction of the MAC subkey used for credential verification. This vulnerability is fixed in 0.5.18.

CVSS Metrics

Common Vulnerability Scoring System

Vector String:

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Known Affected Software

1 configuration(s) from 1 vendor(s)

debian_linux

Version:

11.0

CPE:

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

This vulnerability affects 1 software configuration(s). Ensure you patch all affected systems.

Available Security Patches

2 patches available from vendors

View All Patches

SUSE

CVE-2026-25506

Severity

Unknown

Released

Mar 05, 2026

Security Update

View Details Vendor Page

Canonical (Ubuntu)

USN-8040-1

USN-8040-1: MUNGE vulnerability

Severity

Unknown

Released

Feb 12, 2026

Security Update

View Details Vendor Page

Browse All Security Patches

References & Resources

Severity Details

7.7

out of 10.0

High

Weakness Type (CWE)

CWE-787 Top 25 #2

Out-of-bounds Write

Description: The product writes data past the end, or before the beginning, of the intended buffer.
Exploit Likelihood: High
Typical Severity: High
Abstraction Level: Base