Skip to main content
View

Vulnerability Assessment

Weakness
CWE
CWE-193
ASVS 5.0
V15 - Secure Coding and Architecture Off-by-one prevention
Impact

CVSS score of 7.8 (HIGH). Attack characteristics: local attack vector, low complexity, low privileges required, no user interaction not required. Public proof-of-concept exploit code is available.
Exploit ScenarioDerived

Successful exploitation could compromise the high-severity affected system.
Act Now Prioritize within 24-48h. Why: In CISA KEV with patch available.
Exploited in the wild (CISA KEV) Patch available 99.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability is classified under CWE-193. Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character. Affected products include: Sudo Project Sudo, Fedoraproject Fedora, Debian Debian Linux, Netapp Active Iq Unified Manager, Netapp Cloud Backup. Version information: before 1.9.5.

Know when Sudo gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Added to CISA KEV
Jul 14, 2026 - 04:22 CISA
CVE Published
Jan 26, 2021 - 21:15 nvd
HIGH 7.8

DescriptionNVD

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

Threat Intelligence Overview

EPSS Score
99.3%
Top 0% exploitable
Exploit
POC
Public exploit code exists
Data Quality
4 sources
Confidence: Medium
NVD CVE.org CISA KEV EPSS POC (2) Exploit-DB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV Yes
Public POC Yes
EPSS 99.3%
Patch available Yes
Active threat Yes
Deciding rule
In CISA KEV with patch available
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Out-of-Cycle
Exploitation· derived
Active
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
High

Priority Score

223
Low Medium High Critical
KEV: +50
EPSS: +99
CVSS: +39
PoC: +20
Weaponized: +15
Threat intel: 0
Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Affected Products (CPE)NVD

cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
cpe:2.3:a:sudo_project:sudo:1.9.5:-:*:*:*:*:*:*
cpe:2.3:a:sudo_project:sudo:1.9.5:patch1:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_unified_manager_core_package:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_tools:9:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
cpe:2.3:a:mcafee:web_gateway:8.2.17:*:*:*:*:*:*:*
cpe:2.3:a:mcafee:web_gateway:9.2.8:*:*:*:*:*:*:*
cpe:2.3:a:mcafee:web_gateway:10.0.4:*:*:*:*:*:*:*
cpe:2.3:a:synology:diskstation_manager_unified_controller:3.0:*:*:*:*:*:*:*
cpe:2.3:o:synology:diskstation_manager:6.2:*:*:*:*:*:*:*
+ 12 more

More in Sudo

View all
CVE-2025-32463 CRITICAL POC
9.3 Jun 30

Sudo before 1.9.17p1 contains a local root escalation vulnerability (CVE-2025-32463, CVSS 9.3) through the --chroot opti
CVE-2012-0809 HIGH POC
7.2 Feb 01

Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to execute arbit
CVE-2025-32462 HIGH POC
8.8 Jun 30

Incorrect host matching in Sudo before 1.9.17p1 allows local attackers to execute commands on unintended machines when t
CVE-2013-1775 MEDIUM POC
6.9 Mar 05

sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypas
CVE-2023-22809 HIGH POC
7.8 Jan 18

In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
CVE-2017-1000367 MEDIUM POC
6.4 Jun 05

Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_
CVE-2026-35535 HIGH POC
7.8 Apr 03

Local privilege escalation in Sudo through 1.9.17p2 (fixed in commit 3e474c2) arises because a failed setuid, setgid, or
CVE-2019-14287 HIGH POC
8.8 Oct 17

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and se
CVE-2015-5602 HIGH POC
7.2 Nov 17

sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose full path is d
CVE-2021-23240 HIGH POC
7.8 Jan 12

selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and es
CVE-2023-27320 HIGH POC
7.2 Feb 28

Sudo before 1.9.13p2 has a double free in the per-command chroot feature. Rated high severity (CVSS 7.2), this vulnerabi
CVE-2023-42465 HIGH POC
7.0 Dec 22

Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because applicatio

Same weakness CWE-193 – Off-by-one Error

View all
CVE-2022-34970 CRITICAL POC
9.8
CVE-2021-31875 CRITICAL POC
9.8
CVE-2020-8443 CRITICAL POC
9.8
CVE-2019-14532 CRITICAL POC
9.8
CVE-2019-19906 HIGH POC
7.5
CVE-2026-86297 HIGH POC
8.2
CVE-2019-13306 HIGH POC
7.8
CVE-2019-13305 HIGH POC
7.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

References

Advisories & patches
PATCH http://www.openwall.com/lists/oss-security/2021/09/14/2 PATCH https://www.oracle.com//security-alerts/cpujul2021.html PATCH https://www.oracle.com/security-alerts/cpuapr2022.html PATCH https://www.oracle.com/security-alerts/cpuoct2021.html REF http://seclists.org/fulldisclosure/2021/Feb/42 REF http://www.openwall.com/lists/oss-security/2021/01/27/1 REF http://www.openwall.com/lists/oss-security/2021/01/27/2 REF http://www.openwall.com/lists/oss-security/2024/01/30/8 REF https://kc.mcafee.com/corporate/index?page=content&id=SB10348 REF https://lists.debian.org/debian-lts-announce/2021/01/msg00022.html REF https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CALA5FTXIQBRRYUA2ZQNJXB6OQMAXEII/ REF https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LHXK6ICO5AYLGFK2TAX5MZKUXTUKWOJY/ REF https://security.gentoo.org/glsa/202101-33 REF https://security.netapp.com/advisory/ntap-20210128-0001/ REF https://security.netapp.com/advisory/ntap-20210128-0002/ REF https://support.apple.com/kb/HT212177 REF https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sudo-privesc-jan2021-qnYQfcM REF https://www.beyondtrust.com/blog/entry/security-advisory-privilege-management-for-unix-linux-pmul-basic-and-privilege-management-for-mac-pmm-affected-by-sudo-vulnerability REF https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3156 REF https://www.debian.org/security/2021/dsa-4839 REF https://www.kb.cert.org/vuls/id/794544 REF https://www.sudo.ws/stable.html#1.9.5p2 REF https://www.synology.com/security/advisory/Synology_SA_21_02

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy