Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability
CVE-2025-32463
What this means
This is rated critical severity (9.3 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Sudo Project Sudo, Canonical Ubuntu Linux and Debian Debian Linux, and 5 more are in your estate, and treat that as the priority.
Full vendor description
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
Scoring and exploitation
9.3/ 10
CVSS 3.1 base scoreCritical
Exploitable only with local access without any account, and no one has to click or open anything. High impact on confidentiality, integrity and availability, and it can reach beyond the vulnerable system.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Exploitability
Longer bar: easier to attack
Attack vectorLocalAV:L
Attack complexityLowAC:L
Privileges requiredNonePR:N
User interactionNoneUI:N
ScopeChangedS:C
Impact
Longer bar: more harm
ConfidentialityHighC:H
IntegrityHighI:H
AvailabilityHighA:H
- Elevated attack likelihood (~56.3% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
- Exploited in the wild
- Yes — confirmed exploitation (US CISA )
- Not reported
- Listed product
- Sudo
Weaknesses
CWE-829
Affected products ()
- Sudo Project Sudo
- Canonical Ubuntu Linux
- Debian Debian Linux
- Opensuse Leap
- Redhat Enterprise Linux
- Suse Linux Enterprise Desktop
- Suse Linux Enterprise Real Time
- Suse Linux Enterprise Server for Sap
Show the raw CPE strings (18)
- cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
- cpe:2.3:a:sudo_project:sudo:1.9.17:-:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:24.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:24.10:*:*:*:-:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:25.04:*:*:*:-:*:*:*
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:13.0:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:15.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_desktop:15:sp6:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_desktop:15:sp7:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp2:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp6:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp7:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server_for_sap:12:sp6:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server_for_sap:12:sp7:*:*:*:*:*:*
References
17 links from the CVE record, grouped by site; the vendor's advisory comes first.
sudo.ws3 linksVendor advisory
- changelog (opens in a new tab)Release Notes
- advisories (opens in a new tab)Vendor Advisory
- chroot_bug (opens in a new tab)Vendor Advisory
access.redhat.com1 link
- cve-2025-32463 (opens in a new tab)Third Party Advisory
bugs.gentoo.org1 link
- show_bug.cgi (opens in a new tab)Issue Tracking · Third Party Advisory
explore.alas.aws.amazon.com1 link
- CVE-2025-32463.html (opens in a new tab)Third Party Advisory
security-tracker.debian.org1 link
- CVE-2025-32463 (opens in a new tab)Third Party Advisory
ubuntu.com1 link
- USN-7604-1 (opens in a new tab)Third Party Advisory
openwall.com1 link
- 3 (opens in a new tab)Third Party Advisory
secpod.com1 link
- sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463 (opens in a new tab)Exploit · Third Party Advisory
stratascale.com1 link
- vulnerability-alert-CVE-2025-32463-sudo-chroot (opens in a new tab)Exploit · Third Party Advisory
suse.com2 links
- CVE-2025-32463.html (opens in a new tab)Third Party Advisory
- suse-su-202502177-1 (opens in a new tab)Third Party Advisory
vicarius.io2 links
- cve-2025-32463-detect-sudo-vulnerability (opens in a new tab)Third Party Advisory
- cve-2025-32463-mitigate-sudo-vulnerability (opens in a new tab)Mitigation · Third Party Advisory
iototsecnews.jp1 link
cisa.gov1 link
- known-exploited-vulnerabilities-catalog (opens in a new tab)US Government Resource