CVE-2025-32463
Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability
CVSS
—
Sem CVSS
EPSS
56.3%
p99
KEV
SIM
29 de set. de 2025
Exploit Today
80
0-100
Publicado: — · Última mod.: —
Produto
Sudo / Sudo
Vulnerabilidade
Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability
Adicionado ao KEV
29 de set. de 2025
Corrigir até
20 de out. de 2025
Uso conhecido em ransomware
Não
Descrição resumida
Sudo contains an inclusion of functionality from untrusted control sphere vulnerability. This vulnerability could allow local attacker to leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file.
Ação necessária
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notas
This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://www.sudo.ws/security/advisories/chroot_bug/ ; https://nvd.nist.gov/vuln/detail/CVE-2025-32463