BSD Portsmunge -- CWE-787: Out-of-bounds Write
· CVE-2026-25506 · VuXML entry
https://github.com/dun/munge/security/advisories/GHSA-r9cr-jf4v-75gh reports: MUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer overflow vulnerability in munged (the MUNGE authentication daemon) to leak cryptographic key material from process memory. With the leaked key material, the attacker could forge arbitrary MUNGE …
Affected versions
- munge < 0.5.18
By system
2 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | security/munge | 0.5.16 | vulnerable since 2026-02-14 | |
| NetBSD | security/munge | 0.5.16 | listed since 2026-02-14 | |
| MidnightBSD | security/munge | 0.5.14_2 | in range, by version | |
| FreeBSD | security/munge | 0.5.18 | fixed |