CVE-2025-32463: Sudo privilege escalation via untrusted chroot configuration

CVE-2025-32463 · Severity: critical · CVSS 9.3 · Exploited in the wild · Published 2025-09-29

Sudo, a widely used utility for managing administrative permissions on Linux and Unix systems, contains a vulnerability that allows standard users to gain full root access. By exploiting the tool's chroot feature, an attacker can bypass security restrictions and execute unauthorized commands with the highest level of system privileges. This could lead to a complete system takeover, data theft, or permanent disruption of services.

Technologies: Sudo. Vendors: Sudo.

Quick answers

Is CVE-2025-32463 exploited in the wild?
Yes. CVE-2025-32463 is known to be exploited in the wild, first recorded on 29 September 2025. Treat it as urgent.
How severe is CVE-2025-32463?
Critical severity, with a CVSS score of 9.3, published 29 September 2025.
Which products and versions are affected?
Sudo Project Sudo 1.9.14 to 1.9.17p1.
Is there a fix for CVE-2025-32463?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-32463 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2025-32463?
Check whether you run Sudo. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in Sudo versions 1.9.14 through 1.9.17p1 due to the improper handling of the --chroot (-R) option. When this option is used, Sudo may process the /etc/nsswitch.conf file from within the user-specified (and potentially untrusted) chroot directory before it has fully dropped privileges or validated the environment. A local attacker can create a malicious nsswitch.conf and associated shared libraries within a directory they control, then execute sudo with the --chroot flag to trigger the loading of these libraries. This results in arbitrary code execution as the root user, bypassing sudoers policy restrictions. The issue is addressed in Sudo version 1.9.17p1.

Affected products

  • Sudo Project Sudo 1.9.14 to 1.9.17p1

Timeline

  • 2025-06-30: disclosed: Public disclosure via Openwall oss-security list
  • 2025-09-29: kev added: Added to CISA Known Exploited Vulnerabilities catalog
  • 2025-09-29: advisory: NVD publication date

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.