CVE coverage
View on NVD →
CVE-2021-3156
CVSS 7.8
Actively exploited (KEV)
4 detections found
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Deprecated - Sudo Heap-Based Buffer Overflow Attempt | deprecated | 2026-07-02 |
| splunk | Detect Baron Samedit CVE-2021-3156 | experimental | 2026-05-13 |
| splunk | Detect Baron Samedit CVE-2021-3156 Segfault | experimental | 2026-05-13 |
| splunk | Detect Baron Samedit CVE-2021-3156 via OSQuery | experimental | 2026-05-13 |