CVE-2025-46718: sudo-rs Allows Low Privilege Users to Enumerate Privileges of Others
First published: Mon May 12 2025(Updated: )
sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with limited sudo privileges (e.g. execution of a single command) can list sudo privileges of other users using the `-U` flag. This vulnerability allows users with limited sudo privileges to enumerate the sudoers file, revealing sensitive information about other users' permissions. Attackers can collect information that can be used to more targeted attacks. Systems where users either do not have sudo privileges or have the ability to run all commands as root through sudo (the default configuration on most systems) are not affected by this advisory. Version 0.2.6 fixes the vulnerability.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| sudo-rs | <0.2.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-46718?
CVE-2025-46718 is considered to have moderate severity due to its potential to expose user privilege information.
How do I fix CVE-2025-46718?
To fix CVE-2025-46718, upgrade to version 0.2.6 or later of the sudo-rs software.
Who is affected by CVE-2025-46718?
Users with limited sudo privileges on versions prior to 0.2.6 of sudo-rs are affected by CVE-2025-46718.
What does the CVE-2025-46718 vulnerability allow?
CVE-2025-46718 allows users with limited sudo privileges to list the sudo privileges of other users using the -U flag.
When was CVE-2025-46718 disclosed?
CVE-2025-46718 was disclosed prior to the release of version 0.2.6 of sudo-rs.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/severity
- agent/author
- agent/source
- agent/tags
- agent/event
- vendor/sudo-rs
- canonical/sudo-rs