What happened
Sudo contains an inclusion of functionality from untrusted control sphere vulnerability. This vulnerability could allow local attacker to leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file.
Affected versions
Sudo: See original advisory Fixed: See vendor advisory.
Why it matters
This source correlation may provide earlier visibility while structured CVE metadata is still being updated.
Detection & mitigation
- Review the original advisory and validate affected versions.
- Apply vendor-provided updates or mitigations when available.
Public PoC references
RepositoryAuthorFirst seenReference
Exploit-DB 52352Sudo chroot 1.9.17 - Local Privilege EscalationStratascale2025-07-08VerifiedPoC-in-GitHub · pr0v3rbs/CVE-2025-32463_chwootEscalation of Privilege to the root through sudo binary with chroot option. CVE-2025-32463★ 530pr0v3rbs2025-07-01CandidatePoC-in-GitHub · 4f-kira/CVE-2025-32463★ 14f-kira2025-07-01CandidatePoC-in-GitHub · K1tt3h/CVE-2025-32463-POCCVE-2025-32463 Proof of concept★ 30K1tt3h2025-07-01CandidatePoC-in-GitHub · IC3-512/linux-root-kitEnd-to-end simulation of a Python dependency confusion attack, sudo privilege escalation (CVE-2025-32463), and rootkit-based persistence - with full memory and network forensic analysis.★ 10IC3-5122025-07-01CandidatePoC-in-GitHub · 7r00t/cve-2025-32463-lab★ 27r00t2025-07-01CandidatePoC-in-GitHub · SysMancer/CVE-2025-32463★ 4SysMancer2025-07-02CandidatePoC-in-GitHub · kh4sh3i/CVE-2025-32463Local Privilege Escalation to Root via Sudo chroot in Linux★ 475kh4sh3i2025-07-02CandidatePoC-in-GitHub · neko205-mx/CVE-2025-32463_Exploit★ 0neko205-mx2025-07-02CandidatePoC-in-GitHub · pevinkumar10/CVE-2025-32463Exploit for Local Privilege Escalation in Sudo via Malicious nsswitch.conf with sudo -R. (CVE-2025-32463)★ 3pevinkumar102025-07-02CandidatePoC-in-GitHub · zhaduchanhzz/CVE-2025-32463_POC★ 0zhaduchanhzz2025-07-02CandidatePoC-in-GitHub · robbert1978/CVE-2025-32463_POC★ 0robbert19782025-07-02CandidatePoC-in-GitHub · Mikivirus0/sudoinjectionSudo Local Privilege Escalation CVE-2025-32463 (Best For Cases Where the shell is not stable to spawn a new root shell)★ 2Mikivirus02025-07-03CandidatePoC-in-GitHub · san8383/CVE-2025-32463★ 1san83832025-07-03CandidatePoC-in-GitHub · 0xAkarii/CVE-2025-32463★ 00xAkarii2025-07-03CandidatePoC-in-GitHub · CIA911/sudo_patch_CVE-2025-32463Mr.CIA's manual patching guide for CVE-2025-32463 (Sudo local privilege escalation) on Kali Linux and Ubuntu WSL.★ 0CIA9112025-07-03CandidatePoC-in-GitHub · mirchr/CVE-2025-32463-sudo-chwootPoC for CVE-2025-32463 - Sudo chroot Elevation of Privilege Vulnerability★ 25mirchr2025-07-03CandidatePoC-in-GitHub · ill-deed/CVE-2025-32463_illdeedPrivilege escalation exploit for CVE-2025-32463 using a malicious NSS module injected via sudo -R. This version creates a stealth payload called illdeed, granting root access through a controlled chroot environment.★ 0ill-deed2025-07-04CandidatePoC-in-GitHub · zinzloun/CVE-2025-32463# CVE-2025-32463 – Sudo EoP Exploit (PoC) with precompiled .so★ 14zinzloun2025-07-04CandidatePoC-in-GitHub · 0p5cur/CVE-2025-32463-POC🛡️ Proof of Concept (PoC) for CVE-2025-32463 - Local privilege escalation in sudo (versions 1.9.14 to 1.9.17). This exploit abuses the --chroot option and a malicious nsswitch.conf to execute arbitrary code as root. ⚠️ For educational and authorized testing only.★ 10p5cur2025-07-04CandidatePoC-in-GitHub · gmh5225/Blackash-CVE-2025-32463CVE-2025-32463★ 0gmh52252025-07-05CandidatePoC-in-GitHub · FreeDurok/CVE-2025-32463-PoCProof of Concept for CVE-2025-32463 Local privilege escalation exploit targeting sudo -R on vulnerable Linux systems. For educational and authorized security testing only.★ 5FreeDurok2025-07-06CandidatePoC-in-GitHub · Chocapikk/CVE-2025-32463-lab★ 1Chocapikk2025-07-06CandidatePoC-in-GitHub · K3ysTr0K3R/CVE-2025-32463-EXPLOITA PoC exploit for CVE-2025-32463 - Sudo Privilege Escalation★ 9K3ysTr0K3R2025-07-06CandidatePoC-in-GitHub · SpongeBob-369/cve-2025-32463# cve-2025-32463 - Local Privilege Escalation to Root via Sudo chroot in Linux★ 1SpongeBob-3692025-07-08CandidatePoC-in-GitHub · lowercasenumbers/CVE-2025-32463_sudo_chroot★ 0lowercasenumbers2025-07-08CandidatePoC-in-GitHub · abrewer251/CVE-2025-32463_Sudo_PoCPoC for CVE-2025-32463: Local privilege escalation in sudo via --chroot. Exploits NSS module injection through crafted chroot environments. Designed for security researchers and lab-only environments.★ 1abrewer2512025-07-08CandidatePoC-in-GitHub · morgenm/sudo-chroot-CVE-2025-32463Rust PoC for CVE-2025-32463 (sudo chroot "chwoot" Local PrivEsc)★ 0morgenm2025-07-11CandidatePoC-in-GitHub · MohamedKarrab/CVE-2025-32463Privilege escalation to root using sudo chroot, NO NEED for gcc installed.★ 48MohamedKarrab2025-07-14CandidatePoC-in-GitHub · krypton-0x00/CVE-2025-32463-Chwoot-POC★ 1krypton-0x002025-07-16CandidatePoC-in-GitHub · Rajneeshkarya/CVE-2025-32463This is the exploit for the CVE-2025-32463★ 0Rajneeshkarya2025-07-17CandidatePoC-in-GitHub · MGunturG/CVE-2025-32463Local Privilege Escalation to Root via Sudo chroot in Linux★ 0MGunturG2025-07-18CandidatePoC-in-GitHub · Maalfer/Sudo-CVE-2021-3156Exploit para explotar la vulnerabilidad CVE-2025-32463★ 8Maalfer2025-07-18CandidatePoC-in-GitHub · daryllundy/CVE-2025-32463Proof-of-concept and analysis for CVE-2025-32463★ 0daryllundy2025-07-20CandidatePoC-in-GitHub · AdityaBhatt3010/Sudo-Privilege-Escalation-Linux-CVE-2025-32463-and-CVE-2025-32462A deep dive into two critical Sudo vulnerabilities (CVE‑2025‑32463 & CVE‑2025‑32462) that enable local privilege escalation across major Linux distributions.★ 11AdityaBhatt30102025-07-21CandidatePoC-in-GitHub · ChetanKomal/sudo_exploitCVE-2025-32463★ 0ChetanKomal2025-07-22CandidatePoC-in-GitHub · KaiHT-Ladiant/CVE-2025-32463CVE-2025-32463 - Sudo Chroot Privilege Escalation Exploit★ 2KaiHT-Ladiant2025-07-29CandidatePoC-in-GitHub · y4ney/CVE-2025-32463-lab本项目基于 Docker 搭建了一个用于复现和测试 sudo 本地权限提升漏洞 CVE-2025-32463 的实验环境。★ 4y4ney2025-07-30CandidatePoC-in-GitHub · aldoClau98/CVE-2025-32463Questo script è un proof of concept (PoC) che dimostra una tecnica di privilege escalation (Elevazione di privilegi) sfruttando una vulnerabilità teorica di sudo (es. CVE-2025-32463). Il PoC forza sudo a caricare una libreria .so manipolata sfruttando la funzionalità -R (chroot) e la configurazione personalizzata di NSS (nsswitch.conf).★ 0aldoClau982025-08-05CandidatePoC-in-GitHub · painoob/CVE-2025-32463★ 0painoob2025-08-05CandidatePoC-in-GitHub · 1xPwn/CVE-2025-32463This CVE addresses a vulnerability in sudo versions 1.9.14 to 1.9.17, enabling unauthorized local privilege escalation to root access.★ 251xPwn2025-08-08CandidatePoC-in-GitHub · Yuy0ung/CVE-2025-32463_chwoot用于CVE-2025-32463 sudo_chwoot的权限提升POC，适配了有gcc编译环境和无gcc编译环境的两种情况，下载运行即可一把梭哈★ 3Yuy0ung2025-08-27CandidatePoC-in-GitHub · blackcat4347/CVE-2025-32463_PoC★ 0blackcat43472025-09-05CandidatePoC-in-GitHub · ashardev002/CVE-2025-32463_chwoot🔍 Demonstrate the CVE-2025-32463 privilege-escalation flaw in sudo's chroot feature with this minimal, reproducible proof of concept environment.★ 1ashardev0022025-09-20CandidatePoC-in-GitHub · D3ltaFormation/CVE-2025-32463-Sudo-Chroot-EscapeThis repository contains a Proof of Concept (PoC) for CVE-2025-32463, a vulnerability in sudo allowing a chroot escape to achieve local privilege escalation.★ 0D3ltaFormation2025-09-24CandidatePoC-in-GitHub · AC8999/CVE-2025-32463A Python exploit for CVE-2025-32463, a critical local privilege escalation vulnerability in the Sudo binary on Linux systems. This flaw allows local users to obtain root access by exploiting the --chroot option, which incorrectly uses /etc/nsswitch.conf from a user-controlled directory.★ 0AC89992025-09-30CandidatePoC-in-GitHub · onniio/CVE-2025-32463★ 0onniio2025-10-01CandidatePoC-in-GitHub · khoazero123/CVE-2025-32463# CVE-2025-32463 – Sudo EoP Exploit (PoC) with precompiled .so★ 0khoazero1232025-10-02CandidatePoC-in-GitHub · r3dBust3r/CVE-2025-32463This repository contains an exploit script for CVE-2025-32463, a local privilege escalation involving `chroot` behavior in affected `sudo` versions (1.9.14 through 1.9.17)★ 1r3dBust3r2025-10-07CandidatePoC-in-GitHub · 0x3c4dfa1/CVE-2025-32463sudo --chroot exploit★ 00x3c4dfa12025-10-08CandidatePoC-in-GitHub · ricardomaia/CVE-2025-32463Enviroment and Nuclei template to test CVE-2025-32463★ 0ricardomaia2025-10-09CandidatePoC-in-GitHub · shazed-x/CVE-2025-32463- Vulnerable: sudo 1.9.14, 1.9.15, 1.9.16, 1.9.17 - Patched in: sudo 1.9.17p1 and later - Legacy versions older than 1.9.14 are not affected, as they don't support the --chroot option.★ 0shazed-x2025-10-09CandidatePoC-in-GitHub · cybertechajju/CVE-2025-32463Privilege escalation to root using sudo chroot, NO NEED for gcc installed.★ 7cybertechajju2025-10-12CandidatePoC-in-GitHub · secvulnhub/CVE-2025-32463-EXPLOIT★ 1secvulnhub2025-10-17CandidatePoC-in-GitHub · dr4x-c0d3r/sudo-chrootSudo Vulnerability Local PrivEsc (CVE-2025-32463) POC with Python★ 1dr4x-c0d3r2025-10-17CandidatePoC-in-GitHub · dr4xp/sudo-chrootSudo Vulnerability Local PrivEsc (CVE-2025-32463) POC with Python★ 1dr4xp2025-10-17CandidatePoC-in-GitHub · robbin0919/CVE-2025-32463★ 0robbin09192025-10-19CandidatePoC-in-GitHub · 12bijaya/CVE-2025-32463Sudo chroot privileged escalation PoC★ 112bijaya2025-10-24CandidatePoC-in-GitHub · muhammedkayag/CVE-2025-32463Technical examination of CVE-2025-32463 by Muhammed Kaya.★ 0muhammedkayag2025-10-30CandidatePoC-in-GitHub · NewComrade12211/CVE-2025-32463exploit★ 1NewComrade122112025-11-03CandidatePoC-in-GitHub · ankitpandey383/CVE-2025-32463-Sudo-Privilege-EscalationPractical security research project exploiting CVE-2025-32463 to gain root access on a vulnerable sudo version. Includes write-up, PoC, and mitigation steps.★ 0ankitpandey3832025-11-16CandidatePoC-in-GitHub · justjoeyking/CVE-2025-32463Chroot Privilege Escalation★ 0justjoeyking2025-11-27CandidatePoC-in-GitHub · Mr-Alperen/CVE-2025-32463★ 0Mr-Alperen2025-12-25CandidatePoC-in-GitHub · SpycioKon/CVE-2025-32463CVE-2025-32463★ 0SpycioKon2026-02-05CandidatePoC-in-GitHub · vpr-labs/CVE-2025-32463C reimplementation of chwoot PoC★ 0vpr-labs2026-02-20CandidatePoC-in-GitHub · danilo1992-sys/CVE-2025-32463★ 0danilo1992-sys2026-02-22CandidatePoC-in-GitHub · 0xBlackash/CVE-2025-32463CVE-2025-32463★ 00xBlackash2026-03-03CandidatePoC-in-GitHub · Fomovet/cve-2025-32463POC for CVE-2025-32463★ 0Fomovet2026-06-21CandidatePoC-in-GitHub · 0xdak/CVE-2025-32463_exploit★ 00xdak2026-08-04CandidateSource timeline
Discovered through CISA Known Exploited VulnerabilitiesView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Record history
Record created from the first normalized source observation.
Metadata and source references refreshed.