When a foundational tool like Sudo can remain hidden for so long, it shows that even mature software warrants continual scrutiny.

According to two critical vulnerabilities published at the National Vulnerability Database,a pair of significant security flaws have been uncovered in Sudo, the widely used command-line tool on Linux and Unix-like systems that lets ordinary users perform tasks with elevated privileges.

These vulnerabilities, CVE-2025-32462 and CVE-2025-https://nvd.nist.gov/vuln/detail/CVE-2025-3246332463, could allow local attackers to gain root access on affected machines, putting many popular Linux distributions at risk.

• CVE-2025-32462, which has been present for over a decade, affects Sudo versions prior to 1.9.17p1. The flaw is tied to the “-h” (host) option in Sudo, which is intended to let administrators specify which host a command can be run on. However, due to this bug, users listed in the sudoers configuration for a different host might inadvertently be granted privileges on the local machine. This issue is particularly concerning for organizations that distribute a shared sudoers file across multiple systems or use LDAP-based sudoers management, as it could unintentionally broaden user access in complex environments.
• The second vulnerability, CVE-2025-32463, is even more severe, earning a high CVSS score of 9.3. It exploits Sudo’s “-R” (chroot) option, which allows commands to be run in a user-defined root directory. Attackers can manipulate this feature by placing a crafted “/etc/nsswitch.conf” file in a directory they control, tricking Sudo into loading malicious code and granting root privileges. Notably, this flaw impacts default Sudo configurations and does not require any special permissions, meaning any local user could potentially exploit it if the vulnerable version is installed.

Both vulnerabilities have been patched in Sudo version 1.9.17p1, released after responsible disclosure in April 2025. Major Linux distributions, including AlmaLinux, Alpine Linux, Amazon Linux, Debian, Gentoo, Oracle Linux, Red Hat, SUSE, and Ubuntu, have issued advisories and updates.

Security experts urge all users and administrators to apply these updates promptly to protect systems from potential privilege escalation attacks.