Munge, an authentication service issuing user credentials, contains a buffer overflow in the daemon munged when unpacking messages. The flaw lets a locally privileged attacker overflow a memory buffer by supplying an oversized address length field. This overflow corrupts munged's internal state and exposes the MAC subkey used for credential verification. With that key, the attacker can forge arbitrary credentials, potentially impersonating any user, including root, on any service that relies on Munge authentication. The weakness is a classic out‑of‑bounds write (CWE‑787).

The vulnerability exists in Munge versions 0.5 to 0.5.17 on Linux platforms. Common affected distributions include Debian Linux 11.0 and openSUSE releases that ship the vulnerable packages. The manufacturer is dun, and the specific software is the Munge authentication daemon.

The CVSS score of 7.7 categorizes the issue as a high severity vulnerability, though the EPSS score of less than 1 percent indicates a low probability of exploitation in the wild. Munge is not listed in the CISA KEV catalog. Attacking this flaw requires local access; the attacker needs to establish a connection to munged and send the crafted payload. The exploit is relatively straightforward for a local attacker, but privileged or unprivileged local users may be able to gain the necessary access to communicate with the daemon.