CVSS—
Severityhigh
Weakness—
EPSS100.0%100.0th percentile
Exploited3 KEV sources
Ransomware useUnknown
Federal fix dueApr 27, 2022
patch window
Called exploited 435 days after disclosure.
Measured from the CVE publication date to the earliest of 3 KEV catalogues that list it.
The life of this vulnerability
- CVE published
- First KEV listing1.2y
- Last sighting4.4y
Gaps are compressed to equal steps. The elapsed time is printed under each.
Which catalogues call it exploited
- CISA KEVUS federallisted Apr 6, 2022
- EUVDENISA, European Unionlisted Apr 6, 2022
- VulnCheck KEVcommercial researchlisted Apr 6, 2022
- CIRCLaggregator, mirrors the abovelisted Apr 6, 2022, not counted
Sources3 of 3
Listings differ by0 d
Strongest claimconfirmed
3 catalogues list it. CIRCL aggregates the others and is shown but not counted.
Public exploitation evidence
- reported exploitationblog.talosintelligence.com/uat-10147-chinese-speaking-advers
- reported exploitationwww.recordedfuture.com/blog/july-2026-cve-landscape
- reported exploitationhunt.io/blog/thailand-ministry-finance-targeted-with-hermes-
- reported exploitationunit42.paloaltonetworks.com/infiltration-of-global-telecom-n
- reported exploitationsecurelist.com/vulnerabilities-and-exploits-in-q1-2025/11662
- reported exploitationwww.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligenc
10 public reports collected from VulnCheck and CIRCL, first on Apr 6, 2022. Each links to its original source. We have not verified them.
Description
Sudo contains an off-by-one error that can result in a heap-based buffer overflow, which allows for privilege escalation.
Required action (CISA)
Apply updates per vendor instructions.
