CVE-2025-32463: Sudo chroot local privilege escalation via untrusted nsswitch.conf

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityA locally reachable, low-complexity sudo flaw that yields root, is listed in CISA KEV with documented exploit references and a very high EPSS score.

What it is

Sudo before 1.9.17p1 loads /etc/nsswitch.conf from a user-controlled directory when the --chroot option is used, allowing inclusion of functionality from an untrusted control sphere. A local user can therefore influence configuration read by a privileged process and escalate to root. The flaw affects sudo and multiple Linux distributions that ship it.

Impact

An attacker with a local account gains full root privileges, giving complete control of the host including credential access, persistence and data modification.

Attack surface

Reached locally by running sudo with the --chroot option pointed at a directory the attacker controls; no authentication beyond a local user session and no user interaction are required, per the AV:L/PR:L/UI:N vector.

Exploitation

CVE-2025-32463 is listed in CISA KEV with a 2025-10-20 remediation due date, and two references are tagged Exploit; EPSS 30-day probability is 0.59417 (99th percentile). No ransomware campaign use is documented.

What to do

• Upgrade sudo to 1.9.17p1 or later, or apply the vendor update for your distribution (Ubuntu USN-7604-1, SUSE, Red Hat, Debian advisories).
• If patching is not immediately possible, restrict or remove use of sudo's --chroot option and limit sudo privileges to trusted users.
• Ensure directories passed to sudo --chroot are not writable by unprivileged users, and audit for attacker-controlled nsswitch.conf files.
• Track KEV remediation deadlines and verify patched sudo versions across all Linux hosts, including containers and build images.

Detection

• Alert on sudo executions using the --chroot option, especially with paths under user-writable directories such as /tmp, /home or /var/tmp.
• Monitor for creation or modification of nsswitch.conf files outside /etc and for unexpected root-owned processes spawned by sudo.
• Audit sudo version inventory to find hosts still running versions before 1.9.17p1.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.