CVE-2025-32463
HIGHCVSS 7.8/10Actively ExploitedEPSS 47.47%
Last modified
CVE-2025-32463 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.. CISA has confirmed active exploitation in the wild. EPSS estimates a 47.47% chance of exploitation in the next 30 days.
Description
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Sudo Project | Sudo | >= 1.9.14, < 1.9.17 | — |
| Sudo Project | Sudo | 1.9.17 | — |
| Canonical | Ubuntu Linux | 22.04 | — |
| Canonical | Ubuntu Linux | 24.04 | — |
| Canonical | Ubuntu Linux | 24.10 | — |
| Canonical | Ubuntu Linux | 25.04 | — |
| Debian | Debian Linux | 11.0 | — |
| Debian | Debian Linux | 12.0 | — |
| Debian | Debian Linux | 13.0 | — |
| Opensuse | Leap | 15.6 | — |
| Redhat | Enterprise Linux | 10.0 | — |
| Suse | Linux Enterprise Desktop | 15 | Sp6 |
| Suse | Linux Enterprise Real Time | 15.0 | Sp2 |
| Suse | Linux Enterprise Server For Sap | 12 | Sp6 |
References
- https://access.redhat.com/security/cve/cve-2025-32463Third Party Advisory
- https://bugs.gentoo.org/show_bug.cgi?id=CVE-2025-32463Issue Tracking, Third Party Advisory
- https://explore.alas.aws.amazon.com/CVE-2025-32463.htmlThird Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2025-32463Third Party Advisory
- https://ubuntu.com/security/notices/USN-7604-1Third Party Advisory
- https://www.openwall.com/lists/oss-security/2025/06/30/3Third Party Advisory
- https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chrootExploit, Third Party Advisory
- https://www.sudo.ws/releases/changelog/Release Notes
- https://www.sudo.ws/security/advisories/Vendor Advisory
- https://www.sudo.ws/security/advisories/chroot_bug/Vendor Advisory
- https://www.suse.com/security/cve/CVE-2025-32463.htmlThird Party Advisory
- https://www.suse.com/support/update/announcement/2025/suse-su-202502177-1/Third Party Advisory
- https://www.vicarius.io/vsociety/posts/cve-2025-32463-detect-sudo-vulnerabilityThird Party Advisory
- https://www.vicarius.io/vsociety/posts/cve-2025-32463-mitigate-sudo-vulnerabilityMitigation, Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32463US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-32463?
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
How severe is CVE-2025-32463?
CVE-2025-32463 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 47.47% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
How do I fix CVE-2025-32463?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-32458The Quantenna Wi-Fi chipset ships with a local control scrip…7.8
- CVE-2025-32459The Quantenna Wi-Fi chipset ships with a local control scrip…7.8
- CVE-2025-3246An improper neutralization of input vulnerability was identi…7.6
- CVE-2025-32460GraphicsMagick before 8e56520 has a heap-based buffer over-r…9.1
- CVE-2025-32461wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_include…9.9
- CVE-2025-32462Sudo before 1.9.17p1, when used with a sudoers file that spe…8.8
- CVE-2025-32464HAProxy 2.2 through 3.1.6, in certain uncommon configuration…6.8
- CVE-2025-32465A stored XSS vulnerability in RSTickets! component 1.9.12 - …8.5
- CVE-2025-32466A SQL injection vulnerability in RSMediaGallery! component 1…6.7
- CVE-2025-32467Use of uninitialized variable for some TDX Module before ver…5.6
- CVE-2025-32468A memory corruption vulnerability exists in the BMPv3 Image …8.8
- CVE-2025-32469A vulnerability has been identified in RUGGEDCOM ROX MX5000 …9.9
Are you affected by CVE-2025-32463?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST