Skip to content
OpenAdvisories
High USN-8040-1 1 CVE

munge vulnerability

Published Feb 12, 2026 · Updated Oct 27, 2026

Ecosystem: Ubuntu

Summary

Titouan Lazard discovered that MUNGE contained an exploitable buffer
overflow in munged (the MUNGE authentication daemon). A local attacker
could possibly use this issue to forge MUNGE credentials, leading to
arbitrary code execution.

Fixed packages 7

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS munge 0.5.14-6ubuntu0.1
Ubuntu · 24.04 LTS 24.04:LTS munge 0.5.15-4ubuntu0.1
Ubuntu · 25.10 munge 0.5.16-1ubuntu0.1
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS munge 0.5.11-1ubuntu1.1+esm1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS munge 0.5.11-3ubuntu0.1+esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS munge 0.5.13-1ubuntu0.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS munge 0.5.13-2ubuntu0.1~esm1

Vulnerabilities 1

  • High 7.7
    CVE-2026-25506

    MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery

    MUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer overflow vulnerability in munged (the MUNGE authentication daemon) to leak cryptographic key material from process memory.…

    dun munge munge munge Debian Ubuntu Azure Linux

References

  • report
    https://ubuntu.com/security/CVE-2026-25506