CVE-2025-32462
published 2025-06-30CVE-2025-32462: Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on…
PriorityP259high8.8CVSS 3.1
AVLACLPRLUINSCCHIHAH
EXPLOIT
EPSS
3.31%
87.2th percentile
Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | macos_tahoe | — | — |
| debian | sudo | < sudo 1.9.13p3-1+deb12u2 (bookworm) | sudo 1.9.13p3-1+deb12u2 (bookworm) |
| msrc | azl3_sudo_1.9.17-1_on_azure_linux_3.0 | — | — |
| msrc | cbl2_sudo_1.9.17-1_on_cbl_mariner_2.0 | — | — |
| msrc | cm2_sudo_1.9.17-1_on_cbl_mariner_2.0 | — | — |
| sudo_project | sudo | < 1.9.17 | 1.9.17 |
| sudo_project | sudo | — | — |
| sudo_project | sudo | >= 0 < 1.9.5p2-3+deb11u2 | 1.9.5p2-3+deb11u2 |
| sudo_project | sudo | >= 0 < 1.9.13p3-1+deb12u2 | 1.9.13p3-1+deb12u2 |
| sudo_project | sudo | >= 0 < 1.9.16p2-3 | 1.9.16p2-3 |
| sudo_project | sudo | >= 0 < 1.9.16p2-3 | 1.9.16p2-3 |
| sudo_project | sudo | >= 0 < 1.9.9-1ubuntu2.5 | 1.9.9-1ubuntu2.5 |
| sudo_project | sudo | >= 0 < 1.9.15p5-3ubuntu5.24.04.1 | 1.9.15p5-3ubuntu5.24.04.1 |
| sudo_project | sudo | >= 0 < 1.8.9p5-1ubuntu1.5+esm8 | 1.8.9p5-1ubuntu1.5+esm8 |
| sudo_project | sudo | >= 0 < 1.8.16-0ubuntu1.10+esm3 | 1.8.16-0ubuntu1.10+esm3 |
| sudo_project | sudo | >= 0 < 1.8.21p2-3ubuntu1.6+esm1 | 1.8.21p2-3ubuntu1.6+esm1 |
| sudo_project | sudo | >= 0 < 1.8.31-1ubuntu1.5+esm1 | 1.8.31-1ubuntu1.5+esm1 |
| sudo_project | sudo | >= 1.8.8 < 1.9.17p1 | 1.9.17p1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for sudo invocations that include the -h or --host flag combined with a non-list option (i.e., not -l/--list). This is the core exploit primitive: using -h <remote_host> without -l to bypass host restrictions and elevate privileges. ↗
- →Alert on the specific error message 'a remote host may only be specified when listing privileges' appearing in sudo logs — this indicates the exploit attempt was made (the command still executed as root despite the warning). ↗
- →In LDAP-managed sudoers environments, look for sudoRoles objects using sudoHost values that define privileges across multiple systems — these configurations are exploitable targets. ↗
- →Flag any sudo command where the -h argument resolves to a hostname different from the local system hostname, especially when not paired with -l/--list, as this is the exploit pattern. ↗
- →Audit sudoers files (local and LDAP-distributed) for rules that reference hostnames other than the local system or ALL — these are the prerequisite misconfiguration enabling exploitation. ↗
- ·Environments sharing a single sudoers file across multiple machines (e.g., via LDAP, Ansible, or Golden Images) are at elevated risk because cross-host rules are inherently present. ↗
- ·Affected versions span a wide range: Stable 1.9.0–1.9.17 and Legacy 1.8.8–1.8.32. Fixed version is 1.9.17p1. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
osv8.8HIGH
vendor_debian2.8LOW
vendor_msrc2.8LOW
vendor_redhat2.8LOW
vendor_ubuntu2.8LOW
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apple
CVE-2025-32462: macOS Tahoe 26.1
vendor_apple·2025-11-03·CVSS 2.8
CVE-2025-32462 [LOW] CVE-2025-32462: macOS Tahoe 26.1
Apple Security Update: About the security content of macOS Tahoe 26.1
Product: macOS Tahoe
Version: 26.1
CVE: CVE-2025-32462
Component: CVE-2025-32462
Impact: An app may be able to access user-sensitive data
Description: This issue was addressed with additional entitlement checks.
Apple
CVE-2025-43334: macOS Tahoe 26.1
vendor_apple·2025-11-03·CVSS 2.8
CVE-2025-43334 [LOW] CVE-2025-43334: macOS Tahoe 26.1
Apple Security Update: About the security content of macOS Tahoe 26.1
Product: macOS Tahoe
Version: 26.1
CVE: CVE-2025-43334
Component: CVE-2025-32462
Impact: An app may be able to access user-sensitive data
Description: This issue was addressed with additional entitlement checks.
Red Hat
sudo: LPE via host option
vendor_redhat·2025-06-30·CVSS 2.8
CVE-2025-32462 [LOW] CWE-863 sudo: LPE via host option
sudo: LPE via host option
Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines.
A privilege escalation vulnerability was found in Sudo. In certain configurations, unauthorized users can gain elevated system privileges via the Sudo host option (`-h` or `--host`). When using the default sudo security policy plugin (sudoers), the host option is intended to be used in conjunction with the list option (`-l` or `--list`) to determine what permissions a user has on a different system. However, this restriction can be bypassed, allowing a user to elevate their privileges on one system to the privileges they may have on a different system, effectively ignoring the host ide
Ubuntu
Sudo vulnerability
vendor_ubuntu·2025-06-30·CVSS 2.8
CVE-2025-32462 [LOW] Sudo vulnerability
Title: Sudo vulnerability
Summary: Sudo could be made to bypass host restrictions.
USN-7604-1 fixed CVE-2025-32462 in sudo. This update provides the
corresponding fixes for Ubuntu 20.04 LTS, Ubuntu 18.04 LTS,
Ubuntu 16.04 LTS, and Ubuntu 14.04 LTS.
Original advisory details:
Rich Mirch discovered that Sudo incorrectly handled the host option. In
environments where per-host rules are configured in the sudoers file, a
local attacker could use this issue to bypass the host restrictions.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Sudo vulnerabilities
vendor_ubuntu·2025-06-30·CVSS 2.8
CVE-2025-32463 [LOW] Sudo vulnerabilities
Title: Sudo vulnerabilities
Summary: Several security issues were fixed in Sudo.
Rich Mirch discovered that Sudo incorrectly handled the host option. In
environments where per-host rules are configured in the sudoers file, a
local attacker could use this issue to bypass the host restrictions.
(CVE-2025-32462)
Rich Mirch discovered that Sudo incorrectly handled the chroot option. In
environments where the sudoers file is configured to allow the chroot
option, a local attacker could use this issue to run arbitrary commands as
root. This issue only applied to Ubuntu 24.04 LTS, Ubuntu 24.10, and
Ubuntu 25.04. (CVE-2025-32463)
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL
vendor_msrc·2025-06-10·CVSS 2.8
CVE-2025-32462 [LOW] CWE-863 Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL
Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
mitre: mitre
Customer Action Required: Yes
Debian
CVE-2025-32462: sudo - Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that i...
vendor_debian·2025·CVSS 2.8
CVE-2025-32462 [LOW] CVE-2025-32462: sudo - Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that i...
Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines.
Scope: local
bookworm: resolved (fixed in 1.9.13p3-1+deb12u2)
bullseye: resolved (fixed in 1.9.5p2-3+deb11u2)
forky: resolved (fixed in 1.9.16p2-3)
sid: resolved (fixed in 1.9.16p2-3)
trixie: resolved (fixed in 1.9.16p2-3)
OSV
sudo vulnerabilities
osv·2025-06-30·CVSS 8.8
CVE-2025-32462 [HIGH] sudo vulnerabilities
sudo vulnerabilities
Rich Mirch discovered that Sudo incorrectly handled the host option. In
environments where per-host rules are configured in the sudoers file, a
local attacker could use this issue to bypass the host restrictions.
(CVE-2025-32462)
Rich Mirch discovered that Sudo incorrectly handled the chroot option. In
environments where the sudoers file is configured to allow the chroot
option, a local attacker could use this issue to run arbitrary commands as
root. This issue only applied to Ubuntu 24.04 LTS, Ubuntu 24.10, and
Ubuntu 25.04. (CVE-2025-32463)
OSV
sudo vulnerability
osv·2025-06-30·CVSS 8.8
CVE-2025-32462 [HIGH] sudo vulnerability
sudo vulnerability
USN-7604-1 fixed CVE-2025-32462 in sudo. This update provides the
corresponding fixes for Ubuntu 20.04 LTS, Ubuntu 18.04 LTS,
Ubuntu 16.04 LTS, and Ubuntu 14.04 LTS.
Original advisory details:
Rich Mirch discovered that Sudo incorrectly handled the host option. In
environments where per-host rules are configured in the sudoers file, a
local attacker could use this issue to bypass the host restrictions.
OSV
CVE-2025-32462: Sudo before 1
osv·2025-06-30·CVSS 8.8
CVE-2025-32462 [HIGH] CVE-2025-32462: Sudo before 1
Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines.
GHSA
GHSA-c5x2-97hm-x895: Sudo before 1
ghsa_unreviewed·2025-06-30
CVE-2025-32462 [LOW] CWE-863 GHSA-c5x2-97hm-x895: Sudo before 1
Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines.
No detection rules found.
No writeups or analysis indexed.
https://access.redhat.com/security/cve/cve-2025-32462https://bugs.gentoo.org/show_bug.cgi?id=CVE-2025-32462https://explore.alas.aws.amazon.com/CVE-2025-32462.htmlhttps://lists.debian.org/debian-security-announce/2025/msg00118.htmlhttps://security-tracker.debian.org/tracker/CVE-2025-32462https://ubuntu.com/security/notices/USN-7604-1https://www.openwall.com/lists/oss-security/2025/06/30/2https://www.secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463/https://www.stratascale.com/vulnerability-alert-CVE-2025-32462-sudo-hosthttps://www.sudo.ws/releases/changelog/https://www.sudo.ws/security/advisories/https://www.sudo.ws/security/advisories/host_any/https://www.suse.com/security/cve/CVE-2025-32462.htmlhttps://lists.debian.org/debian-lts-announce/2025/06/msg00033.htmlhttps://cert-portal.siemens.com/productcert/html/ssa-585531.html
2025-06-30
Published