Export limit exceeded: 11550 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 26

Export CSV
CVE-2026-96512

Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization

A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat Sudo Project
Products
Enterprise Linux Enterprise Linux Eus Hardened Images and 10 more
CVE-2026-82474

Sudo through 1.9.17p2 Intercept Policy Bypass via execveat

Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enforcement and logging.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Sudo Project
Products
Sudo
CVE-2026-35535

sudo: Sudo: Privilege escalation due to failure in privilege drop calls

In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Siemens Sudo Project
Products
Ruggedcom Rst2428p Sinec Os Sudo
CVE-2002-0184

security flaw

Sudo before 1.6.6 contains an off-by-one error that can result in a heap-based buffer overflow that may allow local users to gain root privileges via special characters in the -p (prompt) argument, which are not properly expanded.

CVSS 3.1 · 7.8 High EPSS 1.2% KEV · Not listed
Vendors
Debian Redhat Sudo Project
Products
Debian Linux Linux Powertools and 1 more
CVE-2025-32463

sudo: LPE via chroot option

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.

CVSS 3.1 · 9.3 Critical EPSS 56.3% KEV · Listed
Vendors
Canonical Debian Opensuse and 3 more
Products
Ubuntu Linux Debian Linux Leap and 5 more
CVE-2021-3156

sudo: Heap buffer overflow in argument parsing

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

CVSS 3.1 · 7.8 High EPSS 100.0% KEV · Listed
Vendors
Beyondtrust Debian Fedoraproject and 6 more
Products
Privilege Management For Mac Privilege Management For Unix\/linux Debian Linux and 35 more
CVE-2023-42465

sudo: Targeted Corruption of Register and Stack Variables

Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes is based on not equaling an error value (instead of equaling a success value), and because the values do not resist flips of a single bit.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Redhat Sudo Project
Products
Enterprise Linux Openshift Data Foundation Rhel Eus and 1 more
CVE-2025-32462

sudo: LPE via host option

Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines.

CVSS 3.1 · 2.8 Low EPSS 4.5% KEV · Not listed
Vendors
Redhat Sudo Project
Products
Enterprise Linux Rhel Aus Rhel E4s and 4 more
CVE-2022-43995

sudo: heap-based overflow with very small passwords

Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-based buffer over-read. This can be triggered by arbitrary local users with access to Sudo by entering a password of seven characters or fewer. The impact could vary depending on the system libraries, compiler, and processor architecture.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Sudo Project
Products
Sudo
CVE-2017-1000367

sudo: Privilege escalation in via improper get_process_ttyname() parsing

Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.

CVSS 3.0 · 6.4 Medium EPSS 8.1% KEV · Not listed
Vendors
Redhat Sudo Project
Products
Enterprise Linux Rhel Els Sudo
CVE-2017-1000368

sudo: Privilege escalation via improper get_process_ttyname() parsing (insufficient fix for CVE-2017-1000367)

Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_process_ttyname() function resulting in information disclosure and command execution.

CVSS 3.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Redhat Sudo Project
Products
Enterprise Linux Rhel Els Sudo
CVE-2015-8239

sudo: Race condition when checking digests in sudoers

The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.

CVSS 3.0 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Sudo Project
Products
Sudo
CVE-2014-9680

sudo: unsafe handling of TZ environment variable

sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for read access (but not view file contents) by running a program within an sudo session, as demonstrated by interfering with terminal output, discarding kernel-log messages, or repositioning tape drives.

CVSS 3.0 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Redhat Sudo Project
Products
Enterprise Linux Sudo
CVE-2015-5602

sudo: Unauthorized privilege escalation in sudoedit

sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose full path is defined using multiple wildcards in /etc/sudoers, as demonstrated by "/home/*/*/file.txt."

CVSS 2.0 · 7.2 High EPSS 1.5% KEV · Not listed
Vendors
Sudo Project
Products
Sudo
CVE-2023-22809

sudo: arbitrary file write with privileges of the RunAs user

In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.

CVSS 3.1 · 7.8 High EPSS 55.4% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 2 more
Products
Macos Debian Linux Fedora and 8 more
CVE-2023-7090

Sudo: improper handling of ipa_hostname leads to privilege mismanagement

A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privileges even after retracting them.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Sudo Project
Products
Enterprise Linux Sudo
CVE-2021-23240

sudo: symbolic link attack in SELinux-enabled sudoedit

selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by replacing a temporary file with a symlink to an arbitrary file target. This affects SELinux RBAC support in permissive mode. Machines without SELinux are not vulnerable.

CVSS 3.1 · 7.8 High EPSS 1.1% KEV · Not listed
Vendors
Fedoraproject Netapp Redhat and 1 more
Products
Fedora Hci Management Node Solidfire and 2 more