9.3

CVE-2025-32463: Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability

CVSS: 9.3v3.1CriticalKEVAnalyzed
AliasesUBUNTU-CVE-2025-32463DEBIAN-CVE-2025-32463CGA-3qjf-w8hc-4mgg
Published 30-06-2025Last modified 26-02-2026
Open JSON

Vulnerability summary

CVE-2025-32463 is a critical (CVSS 9.3) vulnerability in Sudo. It is known to be exploited: CISA lists it, first on 29-09-2025. EPSS estimates a 55.50% chance of exploitation in the next 30 days, higher than 99% of scored vulnerabilities. 5 public exploits are recorded.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
9.3/10
010
Critical · v3.1 (CVE.org)
EPSS score
55.50%
0%100%
Critical · -3.92 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits5reference, exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 7 · Related 6
MGASA-2025-0213OPENSUSE-SU-2025:15298-1RHSA-2025:11537SUSE-SU-2025:02177-1SUSE-SU-2025:20478-1SUSE-SU-2025:20489-1

Timeline

  1. 30-06-2025
    PublishedVulnerability first disclosed.
  2. 29-09-2025
    Added to CISA KEVSudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability
  3. 20-10-2025
    CISA remediation dueApply mitigations per vendor instructions.
  4. 26-02-2026
    Last modifiedVulnerability information updated.

Description

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

55.50%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

-3.92 pp

From 59.42% on 18-09-2026

18-09-202618-10-2026
EPSS score
55.50%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
29-09-2025
Federal due date
20-10-2025

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. nvd.nist.gov/vuln/detail/CVE-2025-32463

Public exploits

5 found
  • referenceUnverified

    Exploit Reference (iototsecnews.jp)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (stratascale.com)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (secpod.com)

    Maturity: unknown

Show all 5 exploits
  • exploit-databaselocallinuxUnverified

    Sudo chroot 1.9.17 - Local Privilege Escalation

    Maturity: poc

  • MetasploitMetasploitremoteUnverified

    Sudo Chroot 1.9.17 Privilege Escalation

    exploit/linux/local/sudo_chroot_cve_2025_32463

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Suse3 products
Debian2 products
Canonical1 product
Chainguard1 product
  • sudo< 1.9.17-r0
Opensuse1 product
Redhat1 product
Sudo_project1 product
  • sudo≥ 1.9.14, < 1.9.17p1 | ≥ 1.9.14, < 1.9.17 | 1.9.17
Ubuntu1 product
  • sudo< 1.9.15p5-3ubuntu5.24.04.1
Wolfi1 product
  • sudo< 1.9.17-r0

9 vendors · 12 products

References

22 links
Show all 22 references