Vulnerability DatabaseCVE-2025-32462
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2025-32462
June 30, 2025
Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines.
Affected Packages
https://github.com/sudo-project/sudo.git (GITHUB):
Affected version(s) >=v1.8.8 <v1.9.17p1
Fix Suggestion:
Update to version v1.9.17p1
Related Resources (13)
https://www.openwall.com/lists/oss-security/2025/06/30/2
https://access.redhat.com/security/cve/cve-2025-32462
https://security-tracker.debian.org/tracker/CVE-2025-32462
https://lists.debian.org/debian-security-announce/2025/msg00118.html
https://explore.alas.aws.amazon.com/CVE-2025-32462.html
https://bugs.gentoo.org/show_bug.cgi?id=CVE-2025-32462
https://www.suse.com/security/cve/CVE-2025-32462.html
https://www.sudo.ws/releases/changelog/
https://www.sudo.ws/security/advisories/
https://www.sudo.ws/security/advisories/host_any/
https://www.stratascale.com/vulnerability-alert-CVE-2025-32462-sudo-host
https://www.secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463/
https://ubuntu.com/security/notices/USN-7604-1
Do you need more information?
Contact Us
CVSS v4
Base Score:
1.1
Attack Vector
LOCAL
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
NONE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
LOW
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
LOW
Subsequent System Availability
NONE
Exploit Maturity
POC
CVSS v3
Base Score:
2.8
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality
NONE
Integrity
LOW
Availability
NONE
Exploit Maturity
FUNCTIONAL
Weakness Type (CWE)
Incorrect Authorization
CWE-863
EPSS
Base Score:
13.62