CVE-2025-46718

Users with limited sudo privileges (e.g. execution of a single command) can list sudo privileges of other users using the -U flag. This doesn't happen with the original sudo.

PoC

The initial test has been done in a container running Ubuntu 24.04 and installing oxidizr, running sudo-rs 0.2.2.

A user (bob) has been added with only ps command executable through sudo:

root    ALL=(ALL:ALL) ALL
bob     ALL=(ALL:ALL) /usr/bin/ps

The user is not able to read the /etc/sudoers file and running sudo -l -Uroot with original sudo (version 1.9.15p5) causes the following error:

Sorry, user bob is not allowed to execute 'list' as root on 43d4aed3cdbd.

The same command with sudo-rs is run without denying the execution:

User root may run the following commands on 43d4aed3cdbd:
    (ALL : ALL) ALL

The same happens for other non-root users:

bob@43d4aed3cdbd:~$ sudo -l -Ufoo
User foo may run the following commands on 43d4aed3cdbd:
    (ALL : ALL) /usr/bin/whoami

The behavior has been also been observed for version 0.2.5.

Credits

This issue was identified by Sonia Zorba.

Users with limited sudo privileges can enumerate the sudoers file, revealing sensitive information about other users' permissions. Attackers can collect information that can be used to more targeted attacks.

Systems where users either do not have sudo privileges or have the ability to run all commands as root through sudo (the default configuration on most systems) are not affected by this advisory.

CVE-2025-46718 has a CVSS score of 3.3 (Low). The vector is requires local access, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.2.6); upgrading removes the vulnerable code path.

Kodem intelligence

1. What is CVE-2025-46718? CVE-2025-46718 is a low-severity security vulnerability in sudo-rs (rust), affecting versions < 0.2.6. It is fixed in 0.2.6.
2. How severe is CVE-2025-46718? CVE-2025-46718 has a CVSS score of 3.3 (Low). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of sudo-rs are affected by CVE-2025-46718? sudo-rs (rust) versions < 0.2.6 is affected.
4. Is there a fix for CVE-2025-46718? Yes. CVE-2025-46718 is fixed in 0.2.6. Upgrade to this version or later.
5. Is CVE-2025-46718 exploitable, and should I be worried? Whether CVE-2025-46718 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2025-46718 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2025-46718? Upgrade sudo-rs to 0.2.6 or later.