CVE-2021-3156: Sudo off-by-one heap overflow allows root privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityLocal root privilege escalation on a ubiquitous utility with public exploits, KEV listing and near-maximum EPSS probability.

What it is

Sudo before 1.9.5p2 contains an off-by-one error leading to a heap-based buffer overflow. Triggering it via 'sudoedit -s' with a command-line argument ending in a single backslash lets a local user escalate to root. Because sudo is present on most Linux and Unix systems, the flaw has broad reach across enterprise fleets.

Impact

An attacker with a local account gains root privileges, achieving full control of the host including credential access, persistence and lateral movement.

Attack surface

Reached locally by executing sudo or sudoedit with a crafted argument; the CVSS vector shows local access, low privileges and no user interaction, and no authentication beyond an existing local session is required.

Exploitation

CISA added it to KEV on 2022-04-06 with a 2022-04-27 remediation due date, EPSS 30-day probability is 0.99969 (99.977th percentile), and multiple references are tagged Exploit, indicating public exploit code exists.

What to do

• Upgrade sudo to 1.9.5p2 or later, or apply the vendor backport for your distribution.
• Patch all affected products listed by vendors including NetApp, Synology, Oracle, McAfee and BeyondTrust appliances.
• Restrict local shell access and review who holds unprivileged accounts on sudo-enabled hosts.
• Verify the sudo version on every Linux and Unix host, including appliances and embedded systems.
• Monitor vendor advisories for updated builds where the bundled sudo cannot be replaced directly.

Detection

• Alert on sudo or sudoedit process executions whose arguments end with a single backslash.
• Audit sudo version strings across the fleet and flag anything below 1.9.5p2.
• Monitor for unexpected root-level process creation or privilege changes originating from non-root users.
• Review sudo and authentication logs for anomalous sudoedit invocations or crashes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.