CVE-2026-35535
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In Sudo up to version 1.9.17p2 before commit 3e474c2, a failure of setuid, setgid, or setgroups calls during privilege drop before running the mailer is not a fatal error, which can lead to privilege escalation.
Risk Assessment
An attacker could exploit this vulnerability to gain elevated privileges on the system.
Recommendation
Update Sudo to a version that includes commit 3e474c2 or later.
Other vulnerabilities in Sudo
See all- CVE-2026-82474High
Sudo through version 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enforcement and logging.
- CVE-2017-1000368High
Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to input validation (embedded newlines) in the get_process_ttyname() function resulting in information disclosure and command execution.
- CVE-2016-7032High
Sudo versions before 1.8.15 on Linux contain a vulnerability that may allow local users to bypass noexec command restrictions via applications calling the system or popen functions.
- CVE-2017-2381High
An issue was discovered in certain Apple products, including macOS before 10.12.4, related to the 'sudo' component. It allows remote authenticated users to gain privileges by leveraging membership in the admin group on a network directory server.
- CVE-2015-5602High
A vulnerability in sudoedit before version 1.8.15 allows local users to gain privileges via a symlink attack on a file whose full path is defined using multiple wildcards in /etc/sudoers.
- CVE-2025-32462Low
A vulnerability in Sudo before version 1.9.17p1 allows listed users in the sudoers file to execute commands on unintended machines when the file specifies a host that is neither the current host nor ALL.
- CVE-1999-1496Low
Sudo version 1.5 on Debian Linux 2.1 and Red Hat 6.0 allows local users to determine the existence of arbitrary files by attempting to execute the target filename as a program, which generates different error messages when the file does not exist.
- CVE-1999-0958High
Sudo versions 1.5.x allow local users to execute arbitrary commands via a .. (dot dot) attack.
Original NVD description (English source)
In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.