This vulnerability (CVE-2025-32462) in the Sudo project involves incorrect handling of the host option in the sudoers file. When per-host rules are configured specifying a host other than the current host or ALL, sudo incorrectly authorizes command execution on unintended machines. This allows local users with sudo privileges under these configurations to bypass host restrictions. The vulnerability affects Sudo versions prior to 1.9.17p1. Vendor advisories from Ubuntu and Red Hat confirm the issue and provide fixed package versions. The CVSS 3.1 base score is 2.8, reflecting low severity with local attack vector, high attack complexity, low privileges required, no user interaction, scope change, and limited integrity impact.

The impact is limited to local users who have sudo privileges configured with per-host rules that specify hosts other than the current host or ALL. Such users may bypass host restrictions and execute commands on unintended machines. The vulnerability does not affect confidentiality or availability and has a low integrity impact. There are no known exploits in the wild at this time.

Vendor advisories from Ubuntu and Red Hat confirm that the issue is fixed in updated sudo package versions. Users should apply standard system updates to upgrade sudo to the fixed versions listed in the advisories (e.g., Ubuntu sudo 1.9.15p5 or later, Red Hat packages as per their advisory). No additional mitigation steps are required beyond applying these official patches.