CVE coverage
View on NVD →
CVE-2025-32463
CVSS 9.3
Actively exploited (KEV)
6 detections found
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| sigma | Non-Standard Nsswitch.Conf Creation - Potential CVE-2025-32463 Exploitation | experimental | 2026-10-19 |
| elastic | Potential CVE-2025-32463 Nsswitch File Creation | production | 2026-09-18 |
| elastic | Potential CVE-2025-32463 Sudo Chroot Execution Attempt | production | 2026-09-18 |
| splunk | Linux Suspicious GCC Invocation Building Init Shared Object | production | 2026-07-08 |
| splunk | Linux Suspicious Staging of Alternate System Files | production | 2026-07-08 |
| sigma | Linux Sudo Chroot Execution | experimental | 2025-10-02 |