CVE-2025-32463: sudo --chroot local root via user-controlled nsswitch.conf
Exploited in the wild High 7.8 EPSS 56.3%
Since sudo 1.9.14, the -R (--chroot) option resolves paths inside a user-chosen root directory while sudoers is still being evaluated, so a local user can plant an /etc/nsswitch.conf there and make sudo load an arbitrary shared library as root. Any local user can become root, even without sudoers rules. Fixed in sudo 1.9.17p1 (30 June 2025), which also deprecates --chroot; CISA added it to KEV on 29 September 2025.
- CVE-2025-32463CVE identifier
- 7.8CVSS 3.1 base score (high)
- 2025-09-29added to CISA's exploited list (US federal deadline 2025-10-20)
- 56.3%EPSS: chance of exploitation in the next 30 days (higher than 99% of CVEs)
- 2025-06-30published
What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms
What to do now
- Check whether you run the affected software and which version (commands below).
- Install the fixed version for your system: see “Patch it” below.
- Nothing to restart.
- If you cannot patch today, apply the temporary mitigation below and patch as soon as possible.
- Because this flaw is being exploited, also check the server for signs of compromise.
Affected and fixed versions
Affected:
- sudo 1.9.14 through 1.9.17
Fixed in:
- sudo 1.9.17p1
Am I affected?
sudo -V | head -1Patch it
Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.
Debian
sudo apt update
sudo apt install --only-upgrade sudoUbuntu
sudo apt update
sudo apt install --only-upgrade sudoRHEL, AlmaLinux, Rocky, Oracle
sudo dnf upgrade sudoBuilt from source
# build sudo 1.9.17p1 or later from https://www.sudo.ws/General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.
Fix status in Linux distributions
| Release | Package | Status | Fixed version / advisory |
|---|---|---|---|
| Debian 12 | sudo | not affected | |
| Debian 13 | sudo | fixed | 1.9.16p2-3 |
| Debian testing | sudo | fixed | 1.9.16p2-3 |
| Ubuntu 18.04 (ESM) | sudo | not affected | |
| Ubuntu 20.04 (ESM) | sudo | not affected | |
| Ubuntu 22.04 | sudo | not affected | |
| Ubuntu 24.04 | sudo | fixed | 1.9.15p5-3ubuntu5.24.04.1 |
| Red Hat Enterprise Linux 10 | sudo-0:1.9.15-8.p5.el10_0.2 | fixed | RHSA-2025:11537 |
| Debian 13 (trixie) | sudo | fixed | 1.9.16p2-3 |
| Ubuntu 24.04 LTS | sudo | fixed | 1.9.15p5-3ubuntu5.24.04.1 (USN-7604-1) |
| RHEL 10 | sudo | fixed | 1.9.15-8.p5.el10_0.2 (RHSA-2025:11537) |
From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.
If you cannot patch yet
- Not affected: Debian 12 and 11 (vulnerable code introduced later), RHEL 6-9 (Red Hat), and Ubuntu 22.04 and older ship sudo before 1.9.14.
CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://www.sudo.ws/security/advisories/chroot_bug/ ; https://nvd.nist.gov/vuln/detail/CVE-2025-32463
Sources
- CVE record CVE-2025-32463
- NVD CVE-2025-32463
- CISA KEV entry CVE-2025-32463
- Debian security tracker CVE-2025-32463
- Ubuntu CVE page CVE-2025-32463
- Red Hat CVE page CVE-2025-32463
- sudo advisory: Local Privilege Escalation via chroot option
- Stratascale advisory CVE-2025-32463
- oss-security: sudo chroot bug
- https://www.sudo.ws/security/advisories/
- https://www.sudo.ws/releases/changelog/
- https://access.redhat.com/security/cve/cve-2025-32463
- https://ubuntu.com/security/notices/USN-7604-1
- https://explore.alas.aws.amazon.com/CVE-2025-32463.html
- https://bugs.gentoo.org/show_bug.cgi?id=CVE-2025-32463
- https://www.suse.com/support/update/announcement/2025/suse-su-202502177-1/
- https://www.suse.com/security/cve/CVE-2025-32463.html
- https://www.secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463/
- CISA Known Exploited Vulnerabilities catalog
Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.