PT-2026-7436 · Munge+2 · Munge+2

Titouan Lazard · Published 2026-01-01 · Updated 2026-02-25 · CVE-2026-25506

Positive Technologies · (AI Summary)

CVSS v3.1

7.8

High

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MUNGE versions 0.5.0 through 0.5.17

Description MUNGE (MUNGE Uid 'N' Gid Emporium) is an authentication service used by workload managers like Slurm. A buffer overflow exists in the munged daemon, specifically within the msg unpack function when processing messages. This allows a local attacker to potentially forge MUNGE credentials, leading to arbitrary code execution and potential privilege escalation to root. The vulnerability occurs when processing messages with an oversized address length field, corrupting the internal state of munged and enabling the extraction of the MAC subkey used for credential verification. The vulnerability has existed for approximately 20 years. Exploitation involves heap manipulation techniques like tcache poisoning and heap shaping.

Recommendations Update to version 0.5.18 or later.

Exploit

Fix

LPE

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALSA-2026:3032

ALSA-2026:3033

ALSA-2026:3034

BDU:2026-01902

CVE-2026-25506

GHSA-R9CR-JF4V-75GH

OESA-2026-1348

OPENSUSE-SU-2026:10178-1

RHSA-2026:2918

RHSA-2026:2923

RHSA-2026:2934

RHSA-2026:2949

RHSA-2026:2954

RHSA-2026:3010

RHSA-2026:3011

RHSA-2026:3012

RHSA-2026:3013

RHSA-2026:3032

RHSA-2026:3033

RHSA-2026:3034

SUSE-SU-2026:0448-1

SUSE-SU-2026:0450-1

SUSE-SU-2026:0451-1

SUSE-SU-2026:0484-1

USN-8040-1

Affected Products

Linuxmint

Munge

Ubuntu

References · 52

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25506.json · Exploit
• https://github.com/dun/munge/security/advisories/GHSA-r9cr-jf4v-75gh · Vendor Advisory
• https://github.com/dun/munge/commit/bf40cc27c4ce8451d4b062c9de0b67ec40894812 · Patch
• https://ubuntu.com/security/CVE-2026-25506 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1348 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0451-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25506 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8040-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-25506 · Security Note
• https://osv.dev/vulnerability/USN-8040-1 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2026-3032.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2026-3034.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25506 · Security Note
• https://osv.dev/vulnerability/ALSA-2026:3032 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10178-1 · Vendor Advisory