CVE-2026-82474: Sudo through 1.9.17p2 Intercept Policy Bypass via execveat
Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enforcement and logging.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Deployments using Sudo through 1.9.17p2 with ptrace-based intercept mode are affected. The issue applies where intercept policy is relied upon to restrict which programs a user permitted to run commands may execute.
What access does an attacker need?
The attacker needs local access as a user who is permitted to run specific commands through Sudo. They can bypass denied-program restrictions by invoking execveat directly or via fexecve.
What is the impact of successful exploitation?
A permitted user can execute programs that the intercept policy would otherwise deny. The bypass also avoids the policy enforcement and logging expected for those denied executions.