critical9.3Known exploitedPublic exploit code
CVE-2025-32463
Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability
Exploited in the wild
This vulnerability is on the CISA Known Exploited Vulnerabilities list, added 2025-09-29. Federal due date: 2025-10-20.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Sudo chroot 1.9.17 - Local Privilege Escalation2025-07-08 · local · linux
Impact
Sudo contains an inclusion of functionality from untrusted control sphere vulnerability. This vulnerability could allow local attacker to leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sudo Project | Sudo | from 1.9.14 before 1.9.17 Version 1.9.17 |
| Canonical | Ubuntu Linux | Versions 22.04, 24.04, 24.10, 25.04 |
| Debian | Debian Linux | Versions 11.0, 12.0, 13.0 |
| Opensuse | Leap | Version 15.6 |
| Redhat | Enterprise Linux | Version 10.0 |
| Suse | Linux Enterprise Desktop | Version 15 |
| Suse | Linux Enterprise Real Time | Version 15.0 |
| Suse | Linux Enterprise Server For Sap | Version 12 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://access.redhat.com/security/cve/cve-2025-32463
- https://bugs.gentoo.org/show_bug.cgi?id=CVE-2025-32463
- https://explore.alas.aws.amazon.com/CVE-2025-32463.html
- https://security-tracker.debian.org/tracker/CVE-2025-32463
- https://ubuntu.com/security/notices/USN-7604-1
- https://www.openwall.com/lists/oss-security/2025/06/30/3
- https://www.secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463/
- https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot
- https://www.sudo.ws/releases/changelog/
- https://www.sudo.ws/security/advisories/
- https://www.sudo.ws/security/advisories/chroot_bug/
- https://www.suse.com/security/cve/CVE-2025-32463.html
- https://www.suse.com/support/update/announcement/2025/suse-su-202502177-1/
- https://www.vicarius.io/vsociety/posts/cve-2025-32463-detect-sudo-vulnerability
- https://www.vicarius.io/vsociety/posts/cve-2025-32463-mitigate-sudo-vulnerability
- https://iototsecnews.jp/2025/07/01/linux-sudo-chroot-vulnerability-enables-hackers-to-elevate-privileges-to-root/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32463