CVE-2025-32463

9.3

CRITICAL CVSS 3.1

Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability - [Actively Exploited]

Description

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.

INFO

Published Date :

June 30, 2025, 9:15 p.m.

Last Modified :

Sept. 30, 2025, 1:30 p.m.

Remotely Exploit :

No

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Oct 20, 2025

Alert Date: Sep 29, 2025 | 21 days ago

Description :

Sudo contains an inclusion of functionality from untrusted control sphere vulnerability. This vulnerability could allow local attacker to leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes :

This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://www.sudo.ws/security/advisories/chroot_bug/ ; https://nvd.nist.gov/vuln/detail/CVE-2025-32463

Affected Products

The following products are affected by CVE-2025-32463 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product
1	Suse	linux_enterprise_desktop
2	Suse	linux_enterprise_real_time
3	Suse	linux_enterprise_server_for_sap
1	Canonical	ubuntu_linux
1	Redhat	enterprise_linux
1	Debian	debian_linux
1	Opensuse	leap
1	Sudo_project	sudo

: Total Affected Vendor : 6 | Products : 8

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	CRITICAL				[email protected]
	CVSS 3.1	HIGH				[email protected]

Solution

Update Sudo to version 1.9.17p1 or later to address this vulnerability.

Update Sudo to the latest version.
Ensure proper configuration of Sudo to prevent privilege escalation.

Public PoC/Exploit Available at Github

CVE-2025-32463 has a 123 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-32463.

URL	Resource
https://access.redhat.com/security/cve/cve-2025-32463	Third Party Advisory
https://bugs.gentoo.org/show_bug.cgi?id=CVE-2025-32463	Issue Tracking Third Party Advisory
https://explore.alas.aws.amazon.com/CVE-2025-32463.html	Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2025-32463	Third Party Advisory
https://ubuntu.com/security/notices/USN-7604-1	Third Party Advisory
https://www.openwall.com/lists/oss-security/2025/06/30/3	Third Party Advisory
https://www.secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463/	Exploit Third Party Advisory
https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot	Exploit Third Party Advisory
https://www.sudo.ws/releases/changelog/	Release Notes
https://www.sudo.ws/security/advisories/	Vendor Advisory
https://www.sudo.ws/security/advisories/chroot_bug/	Vendor Advisory
https://www.suse.com/security/cve/CVE-2025-32463.html	Third Party Advisory
https://www.suse.com/support/update/announcement/2025/suse-su-202502177-1/	Third Party Advisory
https://www.vicarius.io/vsociety/posts/cve-2025-32463-detect-sudo-vulnerability	Third Party Advisory
https://www.vicarius.io/vsociety/posts/cve-2025-32463-mitigate-sudo-vulnerability	Mitigation Third Party Advisory
https://iototsecnews.jp/2025/07/01/linux-sudo-chroot-vulnerability-enables-hackers-to-elevate-privileges-to-root/	Third Party Advisory

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-32463 is associated with the following CWEs:

CWE-829: Inclusion of Functionality from Untrusted Control Sphere

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-32463 weaknesses.

CAPEC-175: Code Inclusion Code Inclusion CAPEC-201: Serialized Data External Linking Serialized Data External Linking CAPEC-228: DTD Injection DTD Injection CAPEC-251: Local Code Inclusion Local Code Inclusion CAPEC-252: PHP Local File Inclusion PHP Local File Inclusion CAPEC-253: Remote Code Inclusion Remote Code Inclusion CAPEC-263: Force Use of Corrupted Files Force Use of Corrupted Files CAPEC-538: Open-Source Library Manipulation Open-Source Library Manipulation CAPEC-549: Local Execution of Code Local Execution of Code CAPEC-640: Inclusion of Code in Existing Process Inclusion of Code in Existing Process CAPEC-660: Root/Jailbreak Detection Evasion via Hooking Root/Jailbreak Detection Evasion via Hooking CAPEC-695: Repo Jacking Repo Jacking CAPEC-698: Install Malicious Extension Install Malicious Extension

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

robbin0919/CVE-2025-32463

None

Dockerfile Shell

Updated: 16 hours, 17 minutes ago

0 stars 0 fork 0 watcher

Born at : Oct. 19, 2025, 2:22 p.m. This repo has been linked 1 different CVEs too.

dr4xp/sudo-chroot

Sudo Vulnerability Local PrivEsc (CVE-2025-32463) POC with Python

cve cve-2025-32463 ethical-hacking ethical-hacking-tools exploit hacking hacking-tools kali-linux kernel-exploit linux linux-kernel poc privilege-escalation sudo sudo-chroot sudo-exploitation ubuntu vulnerabilities python python3

Python

Updated: 2 days, 12 hours ago

0 stars 0 fork 0 watcher

Born at : Oct. 17, 2025, 5:50 p.m. This repo has been linked 1 different CVEs too.

dr4x-c0d3r/sudo-chroot

Sudo Vulnerability Local PrivEsc (CVE-2025-32463) POC with Python

cve cve-2025-32463 ethical-hacking ethical-hacking-tools hack hacking hacking-tools linux linux-kernel sudo sudo-exploitation vulnerabilities exploit kali-linux privelage-escalation ubuntu sudo-chroot

Python

Updated: 2 days, 14 hours ago

0 stars 0 fork 0 watcher

Born at : Oct. 17, 2025, 3:42 p.m. This repo has been linked 1 different CVEs too.

gotr00t0day/sudopwned

A lightweight command-line tool to detect vulnerable sudo versions on Unix systems.

Makefile C++ Shell

Updated: 1 day ago

4 stars 0 fork 0 watcher

Born at : Oct. 17, 2025, 3:05 p.m. This repo has been linked 2 different CVEs too.

cyberajju/CVE-2025-32463

Privilege escalation to root using sudo chroot, NO NEED for gcc installed.

Updated: 1 week, 1 day ago

0 stars 0 fork 0 watcher

Born at : Oct. 12, 2025, 6:42 a.m. This repo has been linked 1 different CVEs too.

cybershaolin47/CVE-2025-32463_POC

None

cve-2025-32463 exploit exploitdevelopment hacking penetration-testing privesc privilege-escalation redteam

C Shell

Updated: 1 week, 1 day ago

1 stars 0 fork 0 watcher

Born at : Oct. 11, 2025, 3:50 p.m. This repo has been linked 1 different CVEs too.

Otsmane-Ahmed/hackthebox-writeups

My HackTheBox machine writeups and solutions

Updated: 1 week, 3 days ago

0 stars 0 fork 0 watcher

Born at : Oct. 10, 2025, 12:58 a.m. This repo has been linked 9 different CVEs too.

Vitor-D-Anjos/offensive-security-portfolio

Professional penetration testing portfolio featuring complete Active Directory compromises, network security assessments, and detailed technical reports. Includes methodology documentation, exploitation techniques, and remediation strategies. eCPPTv3 | ISC2 CC Certified

Updated: 23 hours, 52 minutes ago

1 stars 0 fork 0 watcher

Born at : Oct. 9, 2025, 5:21 p.m. This repo has been linked 1 different CVEs too.

shazed-x/CVE-2025-32463

- Vulnerable: sudo 1.9.14, 1.9.15, 1.9.16, 1.9.17 - Patched in: sudo 1.9.17p1 and later - Legacy versions older than 1.9.14 are not affected, as they don't support the --chroot option.

Python Shell

Updated: 1 week, 3 days ago

0 stars 0 fork 0 watcher

Born at : Oct. 9, 2025, 9:58 a.m. This repo has been linked 1 different CVEs too.

ricardomaia/CVE-2025-32463

Enviroment and Nuclei template to test CVE-2025-32463

Shell Dockerfile PowerShell

Updated: 1 week, 3 days ago

0 stars 0 fork 0 watcher

Born at : Oct. 9, 2025, 5:53 a.m. This repo has been linked 1 different CVEs too.

0x3c4dfa1/CVE-2025-32463

sudo --chroot exploit

Shell

Updated: 1 week, 4 days ago

0 stars 0 fork 0 watcher

Born at : Oct. 8, 2025, 10:30 p.m. This repo has been linked 1 different CVEs too.

harsh1verma/CVE-Analysis

CVE-2025-32462 & CVE-2025-32463

Updated: 1 week, 5 days ago

0 stars 0 fork 0 watcher

Born at : Oct. 7, 2025, 8:46 a.m. This repo has been linked 2 different CVEs too.

r3dBust3r/CVE-2025-32463

This repository contains an exploit script for CVE-2025-32463, a local privilege escalation involving `chroot` behavior in affected `sudo` versions (1.9.14 through 1.9.17)

Shell

Updated: 1 week, 6 days ago

0 stars 0 fork 0 watcher

Born at : Oct. 7, 2025, 12:17 a.m. This repo has been linked 1 different CVEs too.

onniio/CVE-2025-32463

None

Shell Dockerfile

Updated: 2 weeks, 4 days ago

0 stars 0 fork 0 watcher

Born at : Oct. 1, 2025, 3:07 p.m. This repo has been linked 1 different CVEs too.

Wiz-Works/LearnPeas

Educational Linux privilege escalation script for CTFs/OSCP. Explains WHAT/WHY/HOW for every vulnerability found. Highlights critical findings with red alerts. Extended mode default: cloud metadata, databases, web apps, CI/CD secrets, CTF flags. Teaches privilege escalation patterns, not just commands.

Shell

Updated: 4 days, 16 hours ago

39 stars 5 fork 5 watcher

Born at : Oct. 1, 2025, 4:18 a.m. This repo has been linked 6 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-32463 vulnerability anywhere in the article.

CybersecurityNews

New PoC Exploit Released for Sudo Chroot Privilege Escalation Vulnerability

A critical vulnerability in the widely used Sudo utility has come under scrutiny following the public release of a proof-of-concept exploit, raising alarms for Linux system administrators worldwide. C ...

Published Date: Oct 14, 2025 (5 days, 23 hours ago)

CybersecurityNews

PoC Exploit Released for Sudo Vulnerability that Enables Attackers to Gain Root Access

A publicly available proof-of-concept (PoC) exploit has been released for CVE-2025-32463, a local privilege escalation (LPE) flaw in the Sudo utility that can grant root access under specific configur ...

Published Date: Oct 06, 2025 (1 week, 6 days ago)

TheCyberThrone

CISA Adds Five Actively Exploited Vulnerabilities to KEV Catalog

September 30, 2025The threat landscape continues to evolve rapidly and staying ahead of actively exploited vulnerabilities is key to effective cybersecurity defense. On September 28, 2025, the Cyberse ...