CVE-2026-35535
Privilege Escalation in Sudo via Non-Fatal Privilege Drop Failure
Publication date: 2026-04-03
Last updated on: 2026-04-03
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sudo_project | sudo | 1.9.17p2 |
| sudo_project | sudo | 1.9.15p5 |
| sudo_project | sudo | 1.9.9 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-271 | The product does not drop privileges before passing control of a resource to an actor that does not have those privileges. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the sudo program versions through 1.9.17p2 before a specific patch (commit 3e474c2). It occurs because when sudo tries to drop privileges before running its mailer process, failures in system calls that set user ID (setuid), group ID (setgid), or supplementary groups (setgroups) are not treated as fatal errors. This means that if these calls fail, the mailer may still run with elevated privileges, potentially allowing an attacker to escalate their privileges on the system.
The patch fixes this by ensuring that both user and group IDs are properly set and that any failure in these calls causes the process to exit immediately, preventing the mailer from running with incorrect privileges.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided context and resources do not explicitly discuss the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
How can this vulnerability impact me? :
This vulnerability can lead to privilege escalation, where an unprivileged user might gain higher privileges than intended. Specifically, because the mailer process may run with incorrect or elevated privileges if the privilege dropping calls fail silently, an attacker could exploit this to execute code with elevated rights, compromising system security.
Such privilege escalation can allow unauthorized access to sensitive data, modification of system files, or execution of arbitrary commands with elevated privileges.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There is no specific information provided about detection methods or commands to identify this vulnerability on a network or system.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the sudo package to a version that includes the fix from commit 3e474c2 or later.
The fix ensures that failures in setuid(), setgid(), or setgroups() calls during the mailer execution are treated as fatal errors, preventing privilege escalation.
Ensure your sudo version is at least 1.9.17p2 with the patch applied or a later secure release.