Skip to content
COOEY

FAIL › dossier

Sudo

VENDOR

· dossier confidence 40%

Sudo is a foundational Unix utility for privilege escalation that has recently demonstrated critical security flaws, including an off-by-one heap buffer overflow and a remote code execution vulnerability that bypassed sudoers restrictions. Despite its essential role in system administration, its recent vulnerability history indicates a need for rigorous patching and security monitoring.

Failure events
2
Zero-days
0
RCEs
1
On KEV
2
Critical
0
Worst shame
85
PROFILE
Categorysecurity softwareWhat they doSudo is a command-line utility that allows non-privileged users to execute commands with superuser privileges on Unix-like operating systems.HQOpen Source / Community Websitehttps://www.sudo.ws ↗
SECURITY POSTURE

Sudo has a historically strong security reputation but has suffered from critical, actively exploited vulnerabilities in recent years, including high-severity privilege escalation and remote code execution flaws.

Notable failures
  • CVE-2021-3156 off-by-one heap buffer overflow
  • CVE-2025-32463 -R option RCE bypassing sudoers
  • CVE-2021-3156 actively exploited in the wild
Patterns: critical heap buffer overflows; privilege escalation via command-line option bypasses; actively exploited vulnerabilities
FAILURE HISTORY · 4
DATEEVENTSEVSUMMARY
2022-04-06 CVE-2021-3156 high Sudo's off-by-one heap buffer overflow allows privilege escalation and is actively exploited in the wild.
2022-04-06 CVE-2021-3156 high Sudo's off-by-one heap buffer overflow allows privilege escalation and is actively exploited in the wild.
2025-09-29 CVE-2025-32463 high Sudo's -R option enabled local users to execute arbitrary commands as root without being in sudoers file
2025-09-29 CVE-2025-32463 high Sudo's -R option enabled local users to execute arbitrary commands as root without being in sudoers file
DOSSIER SOURCES
Open questions: current patching cadence for Sudo · adoption of alternative privilege escalation tools
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-08-29 04:06:31.008872+00:00