In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade sudo-python-pluginUpgrade sudo | Apr 29, 2026 | Apr 29, 2026 |
| Amazon_linux_2023 | — | Upgrade sudo-python-plugin-debuginfoUpgrade sudo-python-pluginUpgrade sudo-debugsourceUpgrade sudo-develUpgrade sudoUpgrade sudo-debuginfoUpgrade sudo-logsrvdUpgrade sudo-logsrvd-debuginfo | Apr 14, 2026 | Apr 3, 2026 |
| Debian | — | Upgrade sudo | May 17, 2026 | May 17, 2026 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jul 2, 2026 | Jul 1, 2026 |
| Oracle_linux | — | Upgrade sudoUpgrade sudo-python-plugin | Apr 29, 2026 | Apr 3, 2026 |
| Redhat Openshift | — | Upgrade rhcos | Aug 10, 2026 | Apr 3, 2026 |
| Redhat_linux | — | Upgrade sudo-debuginfoUpgrade sudo-python-plugin-debuginfoUpgrade sudo-debugsourceUpgrade sudoUpgrade sudo-develUpgrade sudo-python-plugin | Apr 29, 2026 | Apr 3, 2026 |
| Rocky_linux | — | Upgrade sudo-debuginfoUpgrade sudo-debugsourceUpgrade sudo-python-plugin-debuginfoUpgrade sudo-python-pluginUpgrade sudo | May 4, 2026 | Apr 30, 2026 |
| Ubuntu | — | Upgrade sudo | Apr 7, 2026 | Apr 6, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Apr 3, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub