CVE-2025-32463 is a local privilege-escalation flaw in Sudo's -R (--chroot) option: Sudo resolves the NSS configuration file /etc/nsswitch.conf from inside the attacker-chosen chroot directory before it evaluates the sudoers policy or drops privileges, so a local user can plant a malicious nsswitch.conf there that points glibc at an attacker-controlled shared library, which Sudo then loads and executes as root — even if that user holds no sudoers entitlement at all.
Vulnerability summary
7.8
High
55.5%
EPSS score (FIRST)
Yes
CISA KEV catalog
2025-06-30
Published
Vulnerability ID: CVE-2025-32463 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Sudo | cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:* | 1.9.14 through 1.9.16 inclusive, and 1.9.17 (pre-release build, before the 1.9.17p1 patch release); fixed in 1.9.17p1 |
What this means
CVE-2025-32463 is an inclusion of functionality from untrusted control sphere (CWE-829) in Sudo's -R/--chroot option. NVD's description states plainly: "Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option" (NVD).
NVD's own Primary analysis scores it CVSS v3.1 7.8 (high), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — local attack vector, low privileges required. The CVE-assigning CNA (MITRE) separately submitted a Secondary score of 9.3 (critical), vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, reflecting that in practice no prior sudoers entitlement is needed; this page reports the NVD Primary figure and flags the higher CNA figure for transparency (NVD).
The Sudo project's own advisory explains the root cause: a change introduced in Sudo 1.9.14 resolves paths, including the system NSS configuration, relative to the user-supplied chroot directory during sudoers file evaluation, which happens before Sudo drops its elevated privileges. A local user can therefore create their own /etc/nsswitch.conf inside a directory they control, point it at an arbitrary NSS module, and have Sudo load that module with root privileges when invoked with -R <their directory>. The fix in 1.9.17p1 reverts this chroot-relative resolution behavior; the Sudo project has additionally deprecated the --chroot option entirely as "error prone" and plans to remove it in a future release. Credit for discovery and analysis goes to Rich Mirch of the Stratascale Cyber Research Unit (Sudo Security Advisory).
CISA added CVE-2025-32463 to the Known Exploited Vulnerabilities catalog on 2025-09-29, with a required-action due date of 2025-10-20; known ransomware campaign use is recorded as "Unknown" as of this writing (CISA KEV).
As of 2026-10-29, FIRST scores the probability of exploitation at 0.5550 (99.033th percentile) — unusually high for a local-only vulnerability, consistent with its ubiquity (Sudo ships on effectively every mainstream Linux and BSD distribution) and the simplicity of the exploitation chain (FIRST EPSS).
Because this affects any multi-user Linux or Unix host running an affected Sudo build with the --chroot option available, operators should upgrade to Sudo 1.9.17p1 or later and, in the interim, restrict or audit use of sudo -R via sudoers policy.
Evidence
- Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option. — NVD
- NVD Primary CVSS v3.1 score is 7.8 (high), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; MITRE's own CNA submission scores it as a Secondary 9.3 (critical), vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. — NVD
- A 1.9.14 change resolves NSS configuration relative to the user-supplied chroot directory during sudoers evaluation, before privileges are dropped, letting a local user supply a malicious /etc/nsswitch.conf that loads an arbitrary shared library as root. Fixed in 1.9.17p1; the --chroot option is now deprecated and slated for removal. Discovered by Rich Mirch, Stratascale Cyber Research Unit. — Sudo Security Advisory
- Added to the CISA Known Exploited Vulnerabilities catalog on 2025-09-29, required-action due date 2025-10-20. — CISA KEV
- EPSS score is 0.5550 (99.033th percentile) as of 2026-10-29. — FIRST EPSS
