CVE-2026-25506Disclosure(debian / debian_linux)

MEDIUMCVSS 7.8 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch debian debian_linux systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

MUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer overflow vulnerability in munged (the MUNGE authentication daemon) to leak cryptographic key material from process memory. With the leaked key material, the attacker could forge arbitrary MUNGE credentials to impersonate any user (including root) to services that rely on MUNGE for authentication. The vulnerability allows a buffer overflow by sending a crafted message with an oversized address length field, corrupting munged's internal state and enabling extraction of the MAC subkey used for credential verification. This vulnerability is fixed in 0.5.18.

debian CVEs Back to dashboard

4.5/ 10 priority

Sources & remediation

Patch / fix

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-787CWE-120

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

debian_linux
munge

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
6 mentions across 4 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 1 signal
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 2 signals
Technical details provided in 5 signals
Disclosure: 3 classified signals
Peaked 2d ago at 2 mentions (2026-02-13); latest day: 1
6 total mentions across 4 days

Affected systems

Vendors

debian opensuse

Products

debian_linuxmunge

1 version affected across 2 products

Deep dive

Activity timeline6 mentions / 4d

Signal classification3 categories

Disclosure

350.0%

Patch

233.3%

Exploit

116.7%

Referenced assets8 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-10	1	Disclosure1
2026-02-13	2	Disclosure1Patch1
2026-02-17	2	Exploit1Patch1
2026-02-19	1	Disclosure1

Full discourse6 posts

Open Source Security mailing list@oss_security232d
Disclosure
CVE-2026-25506: MUNGE 0.5-0.5.17 buffer overflow allowing key leakage https://www.openwall.com/lists/oss-security/2026/02/10/3 In HPC environments where workload managers and other services use MUNGE for authentication, forged credentials could potentially enable privilege escalation
Post summary
CVE‑2026‑25506 is a buffer overflow in MUNGE 0.5‑0.5.17 that can leak keys and potentially allow privilege escalation in HPC environments.
040831.6K
4.4K followersView on X
Mr. OS@ksg93rd233d
Exploit
#exploit #AppSec 1⃣. CVE-2026-25506: Pwning Supercomputers - A 20yo vulnerability in Munge https://blog.lexfo.fr/munge-heap-buffer-overflow.html // Exploitation involved heap spraying, tcache poisoning, and crafting fake chunks to leak internal addresses and ultimately retrieve the Munge secret key 2⃣. ClickOnce + AppDomainManager Injection + ProxyBlob SOCKS5 -> Initial Access https://github.com/dazzyddos/ClickOnceBlobber // It automates the process of patching, compiling, and manifest updating, allowing attackers to embed malicious DLLs into legitimate, signed ClickOnce apps without breaking their signatures or raising suspicion 3⃣. CVE-2025-59793: From Pre-Auth SSRF to RCE in TRUfusion Enterprise https://www.rcesecurity.com/2026/02/when-audits-fail-from-pre-auth-ssrf-to-rce-in-trufusion-enterprise // Exploit chains the path traversal with the previously described SSRF (CVE-2025-32355)
Post summary
The post highlights functional exploit code and detailed attack techniques for multiple CVEs, presenting a clear exploitation narrative without evidence of active wild usage or patching.
10031396
3.1K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds240d
Disclosure
CVE-2026-25506 Local Buffer Overflow in MUNGE Authentication Service Enables Credential Forgery https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25506
Post summary
The passage announces a local buffer overflow vulnerability in the MUNGE Authentication Service that allows credential forgery, but provides no PoC, exploit code, active exploitation evidence, patch, or false-positive claim.
0001058
4.0K followersView on X
Yosuke Katsuki@yokatsuki234d
Patch
AWS ParallelCluster 3.14.1 以前の稼働中クラスターに CVE-2026-25506 対応パッチを適用してみた | DevelopersIO https://ift.tt/fi7p4dA
Post summary
The author applied the available patch for CVE-2026-25506 to an older AWS ParallelCluster 3.14.1 cluster, with no other exploitation or PoC details provided.
0000092
1.8K followersView on X
Ferramentas Linux@Cezar_H_Linux237d
Disclosure
Is your #SUSE Linux Enterprise Server 15 SP6 cluster patched against CVE-2026-25506? This high-severity Munge flaw (CVSS 7.7) is a buffer overflow that could let a local attacker escalate privileges. Read more: 👉 https://tinyurl.com/4nru7ttu #Security https://t.co/RIxBzir7uY
Post summary
The tweet warns that SUSE Linux Enterprise Server 15 SP6 clusters may be vulnerable to a high‑severity buffer overflow in Munge (CVE‑2026‑25506), but offers no proof of concept, exploit code, or patch information.
0000050
1.3K followersView on X
Ferramentas Linux@Cezar_H_Linux237d
Patch
🚨 URGENT: Critical Munge Security Patch for #SUSE/#openSUSE A high-severity buffer overflow (CVE-2026-25506, CVSS 7.7) in message unpacking could allow privilege escalation. Read more: 👉 https://tinyurl.com/489c3tk7 #Security https://t.co/WOiVojDesF
Post summary
Urgent announcement of a critical patch for a high‑severity buffer overflow CVE‑2026‑25506 in Munge on SUSE/openSUSE, allowing privilege escalation.
0000054
1.3K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	debian	debian_linux	11.0	-	-
App	opensuse	munge	-	-	-

Explore more

Back to dashboard debian CVEs opensuse CVEs debian_linux vulnerabilities

What researchers are saying

CVE-2026-25506

Open Source Security mailing list@oss_securityDisclosure

CVE‑2026‑25506 is a buffer overflow in MUNGE 0.5‑0.5.17 that can leak keys and potentially allow privilege escalation in HPC environments.

Mr. OS@ksg93rdExploit

The post highlights functional exploit code and detailed attack techniques for multiple CVEs, presenting a clear exploitation narrative without evidence of active wild usage or patching.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The passage announces a local buffer overflow vulnerability in the MUNGE Authentication Service that allows credential forgery, but provides no PoC, exploit code, active exploitation evidence, patch, or false-positive claim.

Yosuke Katsuki@yokatsukiPatch

The author applied the available patch for CVE-2026-25506 to an older AWS ParallelCluster 3.14.1 cluster, with no other exploitation or PoC details provided.

Ferramentas Linux@Cezar_H_LinuxDisclosure

The tweet warns that SUSE Linux Enterprise Server 15 SP6 clusters may be vulnerable to a high‑severity buffer overflow in Munge (CVE‑2026‑25506), but offers no proof of concept, exploit code, or patch information.

Ferramentas Linux@Cezar_H_LinuxPatch

Urgent announcement of a critical patch for a high‑severity buffer overflow CVE‑2026‑25506 in Munge on SUSE/openSUSE, allowing privilege escalation.