CVE-2025-32463
Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability
CVSS
—
Sin CVSS
EPSS
55.5%
p99
KEV
SÍ
29 sept 2025
Exploit Today
80
0-100
Publicado: — · Última mod.: —
Producto
Sudo / Sudo
Vulnerabilidad
Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability
Añadido a KEV
29 sept 2025
Remediar antes de
20 oct 2025
Uso conocido en ransomware
No
Descripción resumida
Sudo contains an inclusion of functionality from untrusted control sphere vulnerability. This vulnerability could allow local attacker to leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file.
Acción requerida
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notas
This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://www.sudo.ws/security/advisories/chroot_bug/ ; https://nvd.nist.gov/vuln/detail/CVE-2025-32463