{"schema":"threatline.record/2","record":{"id":"CVE-2025-32463","aliases":[],"summary":"Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability","details":"Sudo contains an inclusion of functionality from untrusted control sphere vulnerability. This vulnerability could allow local attacker to leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file.","categories":["Identity & access"],"product":"Sudo","vendor":"Sudo","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-32463","source_modified_at":"2026-02-26T17:50:20.931Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Sudo","vendor":"Sudo project","versions":[{"lessThan":"1.9.17p1","status":"affected","version":"1.9.14","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-32463","source_modified_at":"2026-02-26T17:50:20.931Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Sudo","ecosystem":null},"version":"1.9.17p1","basis":"first unaffected version stated in the CVE record"}],"cvss":9.3,"severity":"Critical","kev":{"listed":true,"date_added":"2025-09-29","due_date":"2025-10-20","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware_campaign_use":"Unknown"},"epss":{"probability":0.55498,"percentile":0.99038,"score_date":"2026-10-23"},"published_at":"2025-06-30T00:00:00.000Z","modified_at":"2026-02-26T17:50:20.931Z","provenance":[{"source":"CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T17:00:09.9001Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2025-32463","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-02-26T17:50:20.931Z"},{"source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/sudo_chroot_cve_2025_32463.rb","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2025-06-30"},{"source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/52352","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2025-07-08"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-32463","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CISA KEV","CVE List","Metasploit","Exploit-DB","EPSS"],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32463","source":"CISA KEV"},{"source":"CVE List","url":"https://www.sudo.ws/security/advisories/"},{"source":"CVE List","url":"https://www.sudo.ws/releases/changelog/"},{"source":"CVE List","url":"https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot"},{"source":"CVE List","url":"https://www.openwall.com/lists/oss-security/2025/06/30/3"},{"source":"CVE List","url":"https://access.redhat.com/security/cve/cve-2025-32463"},{"source":"CVE List","url":"https://ubuntu.com/security/notices/USN-7604-1"},{"source":"CVE List","url":"https://security-tracker.debian.org/tracker/CVE-2025-32463"},{"source":"CVE List","url":"https://explore.alas.aws.amazon.com/CVE-2025-32463.html"},{"source":"CVE List","url":"https://bugs.gentoo.org/show_bug.cgi?id=CVE-2025-32463"},{"source":"CVE List","url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502177-1/"},{"source":"CVE List","url":"https://www.suse.com/security/cve/CVE-2025-32463.html"},{"source":"CVE List","url":"https://www.secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463/"},{"source":"CVE List","url":"https://www.sudo.ws/security/advisories/chroot_bug/"},{"source":"CVE List","url":"https://www.vicarius.io/vsociety/posts/cve-2025-32463-detect-sudo-vulnerability"},{"source":"CVE List","url":"https://www.vicarius.io/vsociety/posts/cve-2025-32463-mitigate-sudo-vulnerability"},{"source":"CVE List","url":"https://iototsecnews.jp/2025/07/01/linux-sudo-chroot-vulnerability-enables-hackers-to-elevate-privileges-to-root/","tags":["exploit"]},{"source":"CVE List","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32463","tags":["government-resource"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"active","automatable":"no","technical_impact":"total","assessed_at":"2025-09-27T03:55:22.188746Z"},"exploits":[{"source":"Metasploit","kind":"Exploit module","name":"Sudo Chroot 1.9.17 Privilege Escalation","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/sudo_chroot_cve_2025_32463.rb","date":"2025-06-30","added":"2026-04-22","check":true},{"source":"Exploit-DB","kind":"Local exploit","name":"Sudo chroot 1.9.17 - Local Privilege Escalation","url":"https://www.exploit-db.com/exploits/52352","date":"2025-07-08","added":"2025-07-08","verified":false}],"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-02-26T17:50:20.931Z","content_hash":"7ec26a0c7c4520051ca1f18642b83a4f6fc091b18616085d3a621d5ee8f894f8"}}