← CVE Intelligence

CVE-2026-35535

Sudo project / Sudo PUBLISHED

Description (CNA)

In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.

Affected (CNA)

Vendor / productVersions
Sudo project / Sudoaffected 0 before 3e474c2f201484be83d994ae10a4e20e8c81bb69

CWE

CWE-271

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

siemens-SADP

No English description supplied.

CVE

No English description supplied.

redhat-SADP

A flaw was found in Sudo. A local user could exploit a failure in the setuid, setgid, or setgroups calls, which are used to drop privileges before running the mailer. This oversight allows for privilege escalation, enabling the user to gain elevated access on the system.