Description
Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Sudo project Sudo
Default version status: unaffected
1.8.8 to < 1.9.17p1affected
References
- https://www.sudo.ws/security/advisories/ ↗
- https://www.sudo.ws/releases/changelog/ ↗
- https://www.stratascale.com/vulnerability-alert-CVE-2025-32462-sudo-host ↗
- https://www.openwall.com/lists/oss-security/2025/06/30/2 ↗
- https://ubuntu.com/security/notices/USN-7604-1 ↗
- https://www.secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463/ ↗
- https://www.sudo.ws/security/advisories/host_any/ ↗
- https://lists.debian.org/debian-security-announce/2025/msg00118.html ↗
- https://explore.alas.aws.amazon.com/CVE-2025-32462.html ↗
- https://bugs.gentoo.org/show_bug.cgi?id=CVE-2025-32462 ↗
- https://security-tracker.debian.org/tracker/CVE-2025-32462 ↗
- https://www.suse.com/security/cve/CVE-2025-32462.html ↗
- https://access.redhat.com/security/cve/cve-2025-32462 ↗
- https://lists.debian.org/debian-lts-announce/2025/06/msg00033.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-585531.html ↗