Sudo Priv Esc via non-fatal setuid failure pre-3e474c2 before 1.9.17p2
CVE-2026-35535 Published on April 3, 2026

In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.

NVD

Vulnerability Analysis

CVE-2026-35535 can be exploited with local system access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
LOCAL
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Types

Privilege Dropping / Lowering Errors

The software does not drop privileges before passing control of a resource to an actor that does not have those privileges. In some contexts, a system executing with elevated permissions will hand off a process/file/etc. to another process or user. If the privileges of an entity are not reduced, then elevated privileges are spread throughout a system and possibly to an attacker.

Least Privilege Violation

The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.


Products Associated with CVE-2026-35535

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Rhel Els
 
Red Hat Openshift
 
Red Hat Enterprise Linux Eus
 
Red Hat Enterprise Linux (RHEL)
 
Red Hat Rhel E4s
 
Red Hat Rhel Eus
 
Red Hat Rhel Aus
 
Red Hat Rhel Tus
 
Red Hat Ai Inference Server
 
Red Hat Rhui
 

Affected Versions

Sudo project Sudo: Siemens RUGGEDCOM RST2428P: Red Hat Update Infrastructure 5: Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION): Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION): Red Hat Enterprise Linux Server (v. 7 ELS): Red Hat Enterprise Linux Server Optional (v. 7 ELS): Red Hat OpenShift Container Platform 4.12: Red Hat OpenShift Container Platform 4.13: Red Hat OpenShift Container Platform 4.14: Red Hat OpenShift Container Platform 4.15: Red Hat OpenShift Container Platform 4.16: Red Hat OpenShift Container Platform 4.17: Red Hat OpenShift Container Platform 4.18: Red Hat OpenShift Container Platform 4.19: Red Hat Enterprise Linux AppStream EUS (v. 10.0): Red Hat Enterprise Linux AppStream (v. 10): Red Hat Enterprise Linux AppStream E4S (v.9.0): Red Hat Enterprise Linux AppStream E4S (v.9.2): Red Hat Enterprise Linux AppStream EUS (v.9.4): Red Hat Enterprise Linux AppStream EUS (v.9.6): Red Hat Enterprise Linux AppStream (v. 9): Red Hat Enterprise Linux BaseOS EUS (v. 10.0): Red Hat Enterprise Linux BaseOS (v. 10): Red Hat Enterprise Linux BaseOS (v. 8): Red Hat Enterprise Linux BaseOS AUS (v.8.6): Red Hat Enterprise Linux BaseOS E4S (v.8.6): Red Hat Enterprise Linux BaseOS TUS (v.8.6): Red Hat Enterprise Linux BaseOS E4S (v.8.8): Red Hat Enterprise Linux BaseOS TUS (v.8.8): Red Hat Enterprise Linux BaseOS E4S (v.9.0): Red Hat Enterprise Linux BaseOS E4S (v.9.2): Red Hat Enterprise Linux BaseOS EUS (v.9.4): Red Hat Enterprise Linux BaseOS EUS (v.9.6): Red Hat Enterprise Linux BaseOS (v. 9): Red Hat AI Inference Server 3.3:

Exploit Probability

EPSS
0.17%
Percentile
7.03%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.