Loading story…
Two vulnerabilities in Sudo—CVE-2025-32462 and CVE-2025-32463—were disclosed as affecting a wide range of Unix and Unix-like platforms, including RHEL, CentOS, AlmaLinux, openSUSE, Ubuntu, Fedora, Debian, Arch Linux, FreeBSD, NetBSD, Oracle Linux, and macOS Sequoia for one of the issues. The more severe flaw, CVE-2025-32463, carries a CVSS 9.3 rating and can allow local privilege escalation to root through Sudo’s chroot-related behavior, while CVE-2025-32462 is a lower-severity issue tied to specific sudoers host-matching configurations that can still permit unauthorized command execution as root.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
CSIRT.SK stated that CVE-2025-32463 was being actively exploited as of 2025-10-01. The update also reiterated the broad platform impact and urged patching or applying workarounds.
The references indicate that updating to sudo 1.9.17p1 or later is the recommended remediation for the disclosed flaws. This establishes the availability of a patched version addressing CVE-2025-32462 and CVE-2025-32463.
Reference content describes two sudo vulnerabilities affecting multiple Unix and Unix-like operating systems. The flaws affect sudo versions prior to 1.9.17p1, with CVE-2025-32463 identified as the more severe issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical security vulnerability, tracked as CVE-2025-32463, has been identified in the Sudo command-line utility used across Linux and Unix-like operating systems. This flaw, which carries a CVSS score of 9.3, allows local attackers to execute arbitrary commands as the root user by exploiting the -R (--chroot) option, even if they are not listed in the sudoers file. The vulnerability affects Sudo versions 1.9.14 through 1.9.17, and was officially disclosed by Stratascale researcher Rich Mirch in June 2025. The issue has existed since the release of Sudo version 1.9.14 in June 2023, and impacts the default configuration, meaning no special sudoers rules are required for exploitation. On July 4, 2025, a proof-of-concept exploit was released by Mirch, and additional exploit code has since circulated publicly, increasing the risk of widespread attacks. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-32463 to its Known Exploited Vulnerabilities (KEV) catalog, confirming evidence of active exploitation in the wild. CISA has mandated that federal agencies apply official mitigations or discontinue the use of vulnerable Sudo versions by October 20, 2025. The vulnerability is described as an 'inclusion of functionality from an untrusted control sphere,' which can be leveraged for privilege escalation. Sudo is a critical utility that allows system administrators to delegate root-level privileges to unprivileged users while maintaining an audit trail, making this flaw particularly dangerous. The specific exploitation method involves using the -R option to bypass sudoers restrictions and gain root access. While CISA has not detailed the specific incidents or threat actors involved, the active exploitation and public availability of exploit code have heightened the urgency for remediation. Organizations worldwide are urged to update to Sudo version 1.9.17p1 or later to mitigate the risk. The vulnerability's impact is significant due to the widespread use of Sudo in enterprise and government environments. Security advisories emphasize the need for immediate action to prevent unauthorized privilege escalation and potential compromise of critical systems. The disclosure and subsequent exploitation of this flaw underscore the importance of timely patch management and monitoring for unusual privilege escalation attempts on Linux and Unix systems.
Jun 29, 2026
Multiple public GitHub repositories published proof-of-concept code and lab material for **CVE-2025-32463**, a local privilege-escalation flaw in `sudo` that attackers claim can be abused to gain **root** on vulnerable Linux systems. The repositories describe exploitation paths involving `sudo -R` and `sudo chroot`, with one project explicitly advertising root escalation without requiring `gcc`, lowering the barrier for hands-on abuse and testing. The disclosures revive long-running concerns around `sudo` and shell-related privilege boundaries. Earlier `sudo` hardening addressed environment-variable abuse in Bash-based scripts under **CVE-2004-1051**, where variables such as `PS4` and `SHELLOPTS` could trigger attacker-controlled command execution, while the **Shellshock** era showed how incomplete Bash fixes could leave similar parser-driven attack paths exposed. Together, the references show a recurring pattern: privileged execution paths that interact with shell behavior or environment handling remain high-value targets, and newly published PoCs for `sudo` flaws can quickly turn theoretical local bugs into practical root-compromise risks.
Jun 29, 2026
Two newly disclosed Linux kernel local privilege escalation flaws are enabling attackers to gain root by corrupting file-backed page-cache memory without changing files on disk. **DirtyClone** (`CVE-2026-43503`) affects the XFRM/IPsec path and abuses cloned packets after a shared-fragment safety flag is dropped during internal copying, while **pedit COW** (`CVE-2026-46331`) affects the traffic-control `act_pedit` subsystem through an out-of-bounds write. Public exploit material shows both bugs can poison the in-memory copy of privileged binaries such as `/usr/bin/su` or `/bin/su`, then execute them to obtain root access while evading file-integrity checks and, in DirtyClone’s case, potentially leaving no on-disk changes or kernel audit evidence. Exploitation in both cases depends on local access plus `CAP_NET_ADMIN`, which researchers say can often be obtained through unprivileged user namespaces on distributions such as Debian, Fedora, and RHEL by default. Reported testing showed successful exploitation on Debian 13 and RHEL 10, with Ubuntu 24.04 requiring an AppArmor-permitted path and Ubuntu 26.04 blocking some default routes despite vulnerable kernels. Upstream fixes have already landed in the Linux 7.1 release candidates, and vendors including Ubuntu, Debian, SUSE, and Red Hat have issued advisories or patches; defenders are being urged to deploy patched kernels, reboot affected systems, and consider disabling unprivileged user namespaces or blocking `act_pedit` where immediate patching is not possible.
Jul 23, 2026