CVE-2025-32463
KEVSudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability
Description
Sudo contains an inclusion of functionality from untrusted control sphere vulnerability. This vulnerability could allow local attacker to leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file.
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
CVSS 3.1 vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HPublishedJun 30, 2025
Last modifiedJun 17, 2026
Added to KEVSep 29, 2025
Remediation dueOct 20, 2025
References
- access.redhat.com/security/cve/cve-2025-32463Third Party Advisory
- bugs.gentoo.org/show_bug.cgi?id=CVE-2025-32463Issue TrackingThird Party Advisory
- explore.alas.aws.amazon.com/CVE-2025-32463.htmlThird Party Advisory
- security-tracker.debian.org/tracker/CVE-2025-32463Third Party Advisory
- ubuntu.com/security/notices/USN-7604-1Third Party Advisory
- openwall.com/lists/oss-security/2025/06/30/3Third Party Advisory
- secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463/ExploitThird Party Advisory
- stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chrootExploitThird Party Advisory
- sudo.ws/releases/changelog/Release Notes
- sudo.ws/security/advisories/Vendor Advisory
- sudo.ws/security/advisories/chroot_bug/Vendor Advisory
- suse.com/security/cve/CVE-2025-32463.htmlThird Party Advisory
0 recent articles mention this CVE
82
Risk assessment · Critical
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 373 days
- CVSS
- 9.3 CRITICAL
- EPSS (30-day exploit probability)
- 55.5% · top 1% of all CVEs
- Weakness
- CWE-829
- Preconditions
- No privileges and no user interaction
Recommended actions
- 1.Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.