Sudo · Sudo
CVE-2025-32463
Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability
What it is
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
CISA: Sudo contains an inclusion of functionality from untrusted control sphere vulnerability. This vulnerability could allow local attacker to leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: October 20, 2025
- Added to the CISA list
- September 29, 2025
- Published
- June 30, 2025
- Severity
- Critical 9.3 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 55% in the top 1.0% of all known vulnerabilities
- Weakness
- CWE-829
- More details
- NVD · CVE.org · CISA
All references (15)
- https://www.sudo.ws/security/advisories/
- https://www.sudo.ws/releases/changelog/
- https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot
- https://www.openwall.com/lists/oss-security/2025/06/30/3
- https://access.redhat.com/security/cve/cve-2025-32463
- https://ubuntu.com/security/notices/USN-7604-1
- https://security-tracker.debian.org/tracker/CVE-2025-32463
- https://explore.alas.aws.amazon.com/CVE-2025-32463.html
- https://bugs.gentoo.org/show_bug.cgi?id=CVE-2025-32463
- https://www.suse.com/support/update/announcement/2025/suse-su-202502177-1/
- https://www.suse.com/security/cve/CVE-2025-32463.html
- https://www.secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-…
- https://www.sudo.ws/security/advisories/chroot_bug/
- https://www.vicarius.io/vsociety/posts/cve-2025-32463-detect-sudo-vulnerability
- https://www.vicarius.io/vsociety/posts/cve-2025-32463-mitigate-sudo-vulnerability
More exploited flaws from Sudo
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Apr 6, 2022 | Heap-Based Buffer Overflow | Sudo | High 7.8 | >99.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.