Search/CVE-2025-32463
● CVE — Critical

CVE-2025-32463

Vendordebian, suse, canonical, redhat, opensuseProductdebian linux, linux enterprise desktop, ubuntu linux, enterprise linux, leap, sudo, linux enterprise real time, linux enterprise server for sapDiscoveredJun 30, 2025UpdatedNov 5, 2025

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.

View graph Watch Export
CVSS v3.1
9.3 CRITICAL
EPSS
55.5%
probability of exploitation in 30 days
CISA KEV
Listed
confirmed active exploitation
News coverage
2
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Oct 3, 2026
▼ 0.84pp
56.3% → 55.5% over 5 tracked changes
CVSS v3.1 Detail
Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Connections
11 relationships
Timeline
disclosure → media coverage
Jun 30, 2025
Disclosure — published as a CVE record. · last revised by NVD Nov 5, 2025
Sep 30, 2025
thehackernews.com reports: CISA Sounds Alarm on Critical Sudo Flaw Actively Exploited in Linux and Unix Systems
Sep 30, 2025
bleepingcomputer.com reports: CISA warns of critical Linux Sudo flaw exploited in attacks
Public PoC (10)
github.com/pr0v3rbs/CVE-2025-32463_chwootgithub.com/4f-kira/CVE-2025-32463github.com/K1tt3h/CVE-2025-32463-POCgithub.com/IC3-512/linux-root-kitgithub.com/7r00t/cve-2025-32463-labgithub.com/SysMancer/CVE-2025-32463github.com/kh4sh3i/CVE-2025-32463github.com/neko205-mx/CVE-2025-32463_Exploitgithub.com/pevinkumar10/CVE-2025-32463github.com/zhaduchanhzz/CVE-2025-32463_POC
Unverified third-party code — review before executing.