Vulnerability DatabaseCVE-2025-32463
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2025-32463
June 30, 2025
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
Affected Packages
https://github.com/sudo-project/sudo.git (GITHUB):
Affected version(s) >=v1.9.14 <v1.9.17p1
Fix Suggestion:
Update to version v1.9.17p1
Related Resources (17)
https://www.openwall.com/lists/oss-security/2025/06/30/3
https://access.redhat.com/security/cve/cve-2025-32463
https://www.vicarius.io/vsociety/posts/cve-2025-32463-mitigate-sudo-vulnerability
https://bugs.gentoo.org/show_bug.cgi?id=CVE-2025-32463
https://iototsecnews.jp/2025/07/01/linux-sudo-chroot-vulnerability-enables-hackers-to-elevate-privileges-to-root/
https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot
https://explore.alas.aws.amazon.com/CVE-2025-32463.html
https://www.secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32463
https://ubuntu.com/security/notices/USN-7604-1
https://www.sudo.ws/releases/changelog/
https://www.vicarius.io/vsociety/posts/cve-2025-32463-detect-sudo-vulnerability
https://www.sudo.ws/security/advisories/
https://www.suse.com/security/cve/CVE-2025-32463.html
https://www.suse.com/support/update/announcement/2025/suse-su-202502177-1/
https://security-tracker.debian.org/tracker/CVE-2025-32463
https://www.sudo.ws/security/advisories/chroot_bug/
Do you need more information?
Contact Us
CVSS v4
Base Score:
9.4
Attack Vector
LOCAL
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
HIGH
Subsequent System Integrity
HIGH
Subsequent System Availability
HIGH
Exploit Maturity
POC
CVSS v3
Base Score:
9.3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Exploit Maturity
FUNCTIONAL
Weakness Type (CWE)
Inclusion of Functionality from Untrusted Control Sphere
CWE-829
EPSS
Base Score:
20.77