CISA has issued a high-priority alert for CVE-2025-32463, a critical vulnerability in Linux’s sudo function that attackers are actively exploiting. This vulnerability allows a regular user on a system to achieve complete administrative (root) access, putting critical infrastructure at risk. Although the flaw only affects a subset of sudo versions (1.9.14–1.9.17), but is frequently used in many businesses. CISA requires remediation for federal agencies by October 20, 2025, and all enterprises are recommended to act quickly by applying the available patch and evaluating systems for indicators of abuse.
CVE-2025-32463 is a local privilege escalation vulnerability found in sudo 1.9.14-1.9.17 that allows unprivileged users to run arbitrary code as root via the –chroot (-R) flag. The exploit requires creating a malicious .conf and libnss_*.so inside a user-controlled chroot, which causes NSS to load attacker-controlled shared objects during sudoers/NSS evaluation. This happens before privileges are eliminated, allowing complete root access outside the chroot. The vulnerability is actively exploited in the wild .
As the Vulnerability is actively exploited in the wild, the flaw is now listed in CISA’s KEV catalog, and patching to sudo 1.9.17p1 or later is strongly recommended.
Exploitation Demonstration:
Platform Impact Differences
Ease of Exploitation:
An attacker with local access can exploit CVE-2025-32463 rather easily if they have a local unprivileged account, are capable to use sudo with -R/–chroot (or a sudoers CHROOT=/runchroot= rule), and have NSS installed via /etc/nsswitch.conf. The vulnerability’s inclusion in CISA’s KEV catalog and publicly available proofs of concept have significantly reduced the barrier to weaponization, even though the attack is not remotely exploitable by default. An adversary can create a chroot with malicious libnss_*.so and a crafted nsswitch.conf to trigger dlopen() during sudo’s NSS lookups and gain root. Unpatched, multi-user, or containerized setups are still quite vulnerable, however hardening (such as deleting chroot rules, patched sudo, or strong loader/AppArmor/SELinux restrictions) makes things more difficult.
Conclusion:
CVE-2025-32463 is a high-risk local privilege escalation that transforms local access into an immediate full-system compromise on susceptible systems. The combination of a widely used utility (sudo), a chroot-related design flaw, and public proof-of-concepts necessitates immediate remediation: upgrade to the fixed sudo release (1.9.17p1 or later), remove or revoke chroot-related sudo rules, look for CHROOT= entries in logs, and assume compromise for any host with suspicious chroot activity. All enterprises should prioritize these procedures as vital security measures.
Exploitation provides attackers immediate root capabilities, allowing for full system compromise: they can read or exfiltrate sensitive data, edit or destroy files and programs, install persistent backdoors, and disable or tamper with logging and detection systems. This compromises confidentiality, integrity, and availability across impacted hosts, allowing for lateral movement to other systems or services. For production, multi-tenant, or high-value environments, the business impact can range from service disruptions and regulatory exposure to long-term breach recovery expenses and reputational harm.
