CVE-2026-35535

A flaw was found in Sudo. A local user could exploit a failure in the setuid, setgid, or setgroups calls, which are used to drop privileges before running the mailer. This oversight allows for privilege escalation, enabling the user to gain elevated access on the system.

A flaw was found in Sudo, rated IMPORTANT by Red Hat, that can allow a local user to escalate privileges on systems running affected versions of the sudo package in Red Hat Enterprise Linux and in other affected Red Hat products such as OpenShift Container Platform 4. When Sudo needs to notify the system administrator by mail (for example, when it encounters an error while parsing /etc/sudoers), it drops its root privileges by calling setuid(), setgid(), and setgroups() before executing the mailer. In Sudo through 1.9.17p2, a failure of these privilege-drop calls was not treated as a fatal error, creating a fail-open condition in which the mailer could be executed with full root privileges instead of those of the invoking user. A local attacker who is able to cause these calls to fail, for example by using a Linux security module such as AppArmor to deny the CAP_SETUID capability to Sudo, could leverage this behavior, in combination with a mailer such as Postfix's sendmail, to execute arbitrary commands as root and gain full root privileges on the system. Red Hat rates this flaw CVSS 3.1 7.4 (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), while NIST rates it 7.8 with low attack complexity; the higher Red Hat attack complexity reflects that exploitation requires an environment in which the privilege-drop syscalls fail, which is not the case in a default installation. Fedora is not affected because the vulnerable code is not present in its sudo packages. For the affected Red Hat products, fixes are being pursued and delivered through their standard update streams.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Users of affected Red Hat products should install the updated sudo packages available through their product's standard update channels.