Sudo Project: community verdicts
4 notable / known-exploited Sudo Project CVEs the community has triaged.
Show as table
| Year published | CVEs | In CISA KEV |
|---|---|---|
| 2021 | 1 | 1 |
| 2022 | 1 | 0 |
| 2023 | 1 | 0 |
| 2024 | 0 | 0 |
| 2025 | 1 | 1 |
Exploitation first, with newly exploited CVEs rising above old ones
- CVE-2021-3156HIGH 7.8KEVEPSS 100%
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
- CVE-2025-32463CRIT 9.3KEVEPSS 55%
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
- CVE-2023-42465HIGH 7Real · low riskEPSS 1%
Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes is based on not equaling an error value (instead of equaling a success value), and because the values do not resist flips of a single bit.
- CVE-2022-43995HIGH 7.1Real · low riskEPSS 0%
Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-based buffer over-read. This can be triggered by arbitrary local users with access to Sudo by entering a password of seven characters or fewer. The impact could vary depending on the system libraries, compiler, and processor architecture.