CVE-2026-82474

Name	CVE-2026-82474
Description	Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enforcement and logging.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1146136

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
sudo (PTS)	bookworm	1.9.13p3-1+deb12u4	vulnerable
	bookworm (security)	1.9.13p3-1+deb12u2	vulnerable
	trixie	1.9.16p2-3+deb13u2	vulnerable
	sid, forky	1.9.17p2-8	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
sudo	source	(unstable)	(unfixed)	unimportant		1146136

https://github.com/sudo-project/sudo/commit/71fbe42dcd5a1c8f799540583a2dfb2ae6221edf
Negligible security impact