CyberSec.Space Logo
CVEブラウザに戻る

CVE-2025-32463

🔥 Known Exploited (CISA KEV)CRITICAL
9.3
CVSS Severity Score
EPSS Score0.0000%
EPSS Percentile0.00th
Published2025-06-30
Last Modified2026-06-17
Data SourcesNVDCISA KEV

Vulnerability Description

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.

Affected Platforms (CPE)

📦
Sudo Project

Sudo

>= 1.9.14 and < 1.9.17= 1.9.17
💻
Canonical

Ubuntu Linux

= 22.04= 24.04= 24.10= 25.04
💻
Debian

Debian Linux

= 11.0= 12.0= 13.0
💻
Opensuse

Leap

= 15.6

References & Advisories

🔗 https://access.redhat.com/security/cve/cve-2025-32463
🔗 https://bugs.gentoo.org/show_bug.cgi?id=CVE-2025-32463
🔗 https://explore.alas.aws.amazon.com/CVE-2025-32463.html
🔗 https://security-tracker.debian.org/tracker/CVE-2025-32463
🔗 https://ubuntu.com/security/notices/USN-7604-1
🔗 https://www.openwall.com/lists/oss-security/2025/06/30/3
🔗 https://www.secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463/
🔗 https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot

関連する脆弱性情報

CVE-2026-64065

In the Linux kernel, the following vulnerability has been resolved: netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() cal...

CVE-2026-614989.8

Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/gen_graphs.php endpoint tha...

CVE-2026-601219.8

Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.php endpoint that allo...

CVE-2026-598009.8

9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install end...