Sudo Local Privilege Escalation via Chroot (CVE-2025-32463)

Historical catalog analysis: CISA added this entry on September 29, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-32463 is a vulnerability categorized under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) affecting Sudo. The flaw allows a local attacker to leverage the -R (or --chroot) option to execute arbitrary commands with root privileges. Notably, this escalation path can be utilized even if the attacking user is not explicitly listed in the sudoers configuration file.

Exposure and applicability

This vulnerability applies to systems running affected versions of Sudo where the -R/--chroot functionality is available. Because Sudo is a ubiquitous component across Linux distributions, this exposure extends to various open-source implementations, third-party libraries, and proprietary products that integrate Sudo.

The primary exposure path is local; an attacker must already have a foothold on the system to execute the command. The risk is heightened in multi-user environments or systems where unprivileged users have shell access, as the vulnerability bypasses traditional sudoers permission checks.

Remediation priorities

Based on the inclusion of this vulnerability in CISA’s Known Exploited Vulnerabilities (KEV) catalog, remediation should be prioritized for all internet-facing infrastructure and high-value internal assets. Our analysis suggests the following priority sequence:

1. Identify Affected Assets: Inventory all Linux instances to determine where Sudo is deployed and identify versions susceptible to this flaw.
2. Apply Vendor Patches: Deploy updates provided by the OS vendor or Sudo maintainers to eliminate the root cause of the untrusted control sphere inclusion.
3. Restrict Access: In environments where immediate patching is not feasible, limit local shell access to trusted administrators to reduce the number of potential local attackers.
4. Cloud Service Review: For organizations utilizing cloud services, review configurations in accordance with BOD 22-01 guidance to ensure managed images are updated.

How to validate remediation

A version check alone is insufficient to prove that the exposure has been reduced, as different distributions may backport fixes or apply custom configurations. To verify mitigation, defenders should perform a functional test of the -R (or --chroot) option using a non-privileged account not listed in the sudoers file.

Verification is successful if the system denies the request to execute commands via the chroot option for unprivileged users. A verified result confirms that the specific exploit path—leveraging the untrusted control sphere to gain root access—is closed.

Limits and open questions

While patching addresses the known vulnerability, residual risk remains if other local privilege escalation paths exist within the system’s broader configuration. It is currently unknown whether this vulnerability has been leveraged by ransomware campaigns. Additionally, because Sudo may be embedded in various third-party proprietary products, organizations may face delays in receiving updates from vendors who do not provide transparent versioning for their integrated Sudo components.

Source and editorial note

CVE-2025-32463: Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability · Source date: September 29, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: October 02, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 02, 2026 at 00:10 UTC.

Request a Vulnerability Assessment