CVE-2026-82474

Sudo versions through 1.9.17p2 fail to apply intercept policy checks to the execveat system call when ptrace-based intercept mode is used to enforce and log which programs a permitted command may run. A local user who is allowed to run specific commands via sudo can therefore execute a denied program by invoking execveat directly, or indirectly through the fexecve wrapper. The attacker gains execution of programs that sudo policy denies, bypassing both policy enforcement and sudo logging, which undermines command restrictions and the audit trail. Systems running sudo 1.9.17p2 or earlier with ptrace-based intercept mode enabled are affected; deployments that use sudo without intercept mode are not exposed to this bypass. No public proof-of-concept, CISA KEV listing, or known in-the-wild exploitation exists, and EPSS estimates only about a 0.1% probability of exploitation within 30 days.

What to do: Upgrade to a sudo release newer than 1.9.17p2 as soon as a fixed version is published by the Sudo Project or your distribution (no fixed version is specified in current data). As an interim mitigation, disable or avoid the intercept option that enables ptrace-based intercept mode, since the bypass exists only in that mode. Administrators who rely on intercept mode should review logs for unexpected program executions by sudo-permitted commands, including launches made through fexecve.