CVE-2025-32463
CriticalActively exploited (CISA KEV)
Description
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
SeverityCritical
CVSS9.3
Exploit probability—
Product
Sudo
PublishedJun 30, 2025
First seenJun 30, 2025
Added to KEVSep 29, 2025
Weakness typeCWE-829CWE-829
How to fix
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date: Oct 20, 2025Update
- sudo_project sudo1.9.17 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sudo_project sudo | 1.9.14 ≤ v < 1.9.17, 1.9.17 | 1.9.17 |
| canonical ubuntu_linux | 22.04, 24.04, 24.10, 25.04 | — |
| debian debian_linux | 11.0, 12.0, 13.0 | — |
| opensuse leap | 15.6 | — |
| redhat enterprise_linux | 10.0 | — |
| suse linux_enterprise_desktop | 15 | — |
| suse linux_enterprise_real_time | 15.0 | — |
| suse linux_enterprise_server_for_sap | 12 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.