CVE-2026-35535

HIGH

Sudo < 3e474c2f201484be83d994ae10a4e20e8c81bb69 - Privilege Escalation via Failed Privilege Drop

Title source: llm
STIX 2.1

Description

In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.

References (33)

Core 33
Core References

Scores

CVSS v3 7.4
EPSS 0.0017
EPSS Percentile 7.0%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-271 CWE-272
Status published
Products (4)
siemens/sinec_os < 4.0
Sudo project/Sudo < 3e474c2f201484be83d994ae10a4e20e8c81bb69
sudo_project/sudo 1.9.17 (3 CPE variants)
sudo_project/sudo < 1.9.17
Published Apr 03, 2026
Tracked Since Apr 03, 2026