CVE-2025-32462

46

FAUCET Score

CVE-2025-32462 is a high-severity vulnerability affecting Sudo before version 1.9.17p1, allowing listed users to execute commands on unintended machines when the sudoers file specifies a host that is neither the current host nor ALL. This local privilege escalation vulnerability has a CVSS score of 8.8, indicating high impact on confidentiality, integrity, and availability with low attack complexity. While not currently in CISA's KEV catalog, an ExploitDB entry (EDB-52354) exists, and the vulnerability has garnered significant community discussion and media coverage, suggesting a high potential for exploitation.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		< 1.9.17CPE matchmatch criteria	cpe:2.3:a:sudo_project:sudo::::::::
		1.9.17CPE matchmatch criteria	cpe:2.3:a:sudo_project:sudo:1.9.17:-::::::
		>= 1.8.8, < 1.9.17p1CPE match	cpe:2.3:a:sudo_project:sudo::::::::

CVSS Data

CVSS version used by this source: 3.1

2.8LOW

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

Exploitability Score

1.1

Impact Score

1.4

CvssVersion

3.1

Exploit Intelligence

EPSS Score

3.67%

Probability of exploitation in next 30 days

EPSS Percentile

88.5%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

ExploitDB: EDB-52354 · Jul 8, 2025

This CVE's current EPSS score of 0.0367 is in the 98th percentile among its peer group of 17,061 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (33)

autodeskpatch availablevia llm_extracted

freepbxpatch availablevia llm_extracted

githubpatch availablevia llm_extracted

honeywellpatch availablevia llm_extracted

microsoftpatch availablevia msrc

Product: cm2 sudo 1.9.17-1 on CBL Mariner 2.0Fixed in: 1.9.17-1

microsoftpatch availablevia msrc

Product: azl3 sudo 1.9.17-1 on Azure Linux 3.0Fixed in: 1.9.17-1

microsoftpatch availablevia msrc

Product: cbl2 sudo 1.9.17-1 on CBL Mariner 2.0Fixed in: 1.9.17-1

microsoftpatch availablevia msrc

Product: 19550-16823Fixed in: 1.9.17-1

microsoftpatch availablevia msrc

Product: 19595-17084Fixed in: 1.9.17-1

microsoftpatch availablevia msrc

Product: 20260-17086Fixed in: 1.9.17-1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsFixed in: sudo-0:1.9.5p2-1.el8_8.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: sudo-0:1.9.5p2-10.el9_6.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.0 Update Services for SAP SolutionsFixed in: sudo-0:1.9.5p2-7.el9_0.5

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsFixed in: sudo-0:1.9.5p2-9.el9_2.3

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.4 Extended Update SupportFixed in: sudo-0:1.9.5p2-10.el9_4.1

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.12Fixed in: rhcos-412.86.202507280202-0

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 10Fixed in: sudo-0:1.9.15-8.p5.el10_0.2

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.14Fixed in: rhcos-414.92.202508041909-0

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.15Fixed in: rhcos-415.92.202507301737-0

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.16Fixed in: rhcos-416.94.202507100308-0

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.17Fixed in: rhcos-417.94.202507291008-0

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.18Fixed in: rhcos-418.94.202507091512-0

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.19Fixed in: rhcos-4.19.9.6.202507081759-0

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.13Fixed in: rhcos-413.92.202509030117-0

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7 Extended Lifecycle SupportFixed in: sudo-0:1.8.23-10.el7_9.4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: sudo-0:1.9.5p2-1.el8_10.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.2 Advanced Update SupportFixed in: sudo-0:1.8.29-5.el8_2.3

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportFixed in: sudo-0:1.8.29-7.el8_4.3

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnFixed in: sudo-0:1.8.29-7.el8_4.3

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportFixed in: sudo-0:1.9.5p2-1.el8_6.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.6 Telecommunications Update ServiceFixed in: sudo-0:1.9.5p2-1.el8_6.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.6 Update Services for SAP SolutionsFixed in: sudo-0:1.9.5p2-1.el8_6.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceFixed in: sudo-0:1.9.5p2-1.el8_8.1

Vendor Advisories (6)

honeywellllm-honeywell-c82b5cfda9df97a3CRITICAL

HP ThinPro 8.1 SP8 Security Updates

autodeskllm-autodesk-c365b674a2ff5a3aCRITICAL

HP ThinPro 8.1 SP8 Security Updates

freepbxllm-freepbx-e54908c7967265f6CRITICAL

HP ThinPro 8.1 SP8 Security Updates

githubllm-github-87d446bd173e473eHIGH

AS-2025-004: Sudo

redhatCVE-2025-32462Important

sudo: LPE via host option

microsoft2025-Jun/CVE-2025-32462Low

Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL

References

cert-portal.siemens.com / productcert/html/ssa-585531.html

lists.debian.org / debian-lts-announce/2025/06/msg00033.html

access.redhat.com / security/cve/cve-2025-32462

bugs.gentoo.org / show_bug.cgi

explore.alas.aws.amazon.com / CVE-2025-32462.html

lists.debian.org / debian-security-announce/2025/msg00118.html

security-tracker.debian.org / tracker/CVE-2025-32462

ubuntu.com / security/notices/USN-7604-1

openwall.com / lists/oss-security/2025/06/30/2

Mailing ListThird Party Advisory

secpod.com / blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463

Third Party Advisory

stratascale.com / vulnerability-alert-CVE-2025-32462-sudo-host

ExploitThird Party Advisory

sudo.ws / releases/changelog

Release Notes

sudo.ws / security/advisories

Vendor Advisory

sudo.ws / security/advisories/host_any

suse.com / security/cve/CVE-2025-32462.html