Active Exploitation of CVE-2025-32463 in the Sudo Command-line Utility

Background

Sudo has released a security update to address a critical vulnerability (CVE-2025-32463) in its command-line utility.

Impact

This vulnerability allows an attacker to leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file.

On systems that support /etc/nsswitch.conf, a user may be able to run arbitrary commands as root.

Known Exploitation

This vulnerability is reportedly being exploited in the wild.

Affected Version

Versions 1.9.14 to 1.9.17

Mitigation 

Users and administrators of affected product versions are strongly advised to update to the latest version immediately.

Reference

https://www.sudo.ws/security/advisories/chroot_bug/

https://nvd.nist.gov/vuln/detail/cve-2025-32463

https://www.cisa.gov/news-events/alerts/2025/09/29/cisa-adds-five-known-exploited-vulnerabilities-catalog

https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot