CVE catalog
CVE-2025-46717
UBUNTU-CVE-2025-46717
- Severity
- Low · CVSS 3.3
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.37% · Oct 25, 2026
sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with no (or very limited) sudo privileges can determine whether files exists in folders that they otherwise cannot access using `sudo --list <pathname>`. Users with local access to a machine can discover the existence/non-existence of certain files, revealing potentially sensitive information in the file names. This information can also be used in conjunction with other attacks. Version 0.2.6 fixes the vulnerability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | rust-sudo-rs | 13 | 0.2.5-5 | fixed |
| Debian | rust-sudo-rs | 14 | 0.2.5-5 | fixed |
| Ubuntu | rust-sudo-rs | 24.04 | 0.2.1-1 | vulnerable |
| Ubuntu | rust-sudo-rs | 24.04 | 0.2.1-2 | vulnerable |
| Ubuntu | rust-sudo-rs | 24.04 | 0.2.2-1 | vulnerable |
| Ubuntu | rust-sudo-rs | 25.10 | 0.2.4-1 | vulnerable |
| Ubuntu | rust-sudo-rs | 25.10 | 0.2.5-3ubuntu1 | vulnerable |
| Ubuntu | rust-sudo-rs | 25.10 | 0.2.5-4 | vulnerable |
| Ubuntu | rust-sudo-rs | 25.10 | 0.2.5-5 | vulnerable |
| Ubuntu | rust-sudo-rs | 25.10 | 0.2.5-5ubuntu1 | vulnerable |
| Ubuntu | rust-sudo-rs | 25.10 | 0.2.5-5ubuntu3 | vulnerable |
| Ubuntu | rust-sudo-rs | 25.10 | 0.2.8-1ubuntu2 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | rust-sudo-rs | deb | 13 | 0.2.5-5 | Not reported | DEBIAN-CVE-2025-46717 | Not reported |
| Debian | rust-sudo-rs | deb | 14 | 0.2.5-5 | Not reported | DEBIAN-CVE-2025-46717 | Not reported |
| Ubuntu | rust-sudo-rs | deb | 25.10 | 0.2.8-1ubuntu2 | Not reported | UBUNTU-CVE-2025-46717 | Not reported |
OpenFactory catalog packages
[Debian 13 (Trixie)]
- [librust-sudo-rs-dev]Fixed
Source package: [rust-sudo-rs]
Details (4)
0.2.5-5+deb13u1· amd64 · trixieFixed · Fixed:
0.2.5-5pypi · rust-sudo-rs · debian · 13
0.2.5-5+deb13u1· arm64 · trixieFixed · Fixed:
0.2.5-5pypi · rust-sudo-rs · debian · 13
0.2.5-5+deb13u1· amd64 · trixie-securityFixed · Fixed:
0.2.5-5pypi · rust-sudo-rs · debian · 13
0.2.5-5+deb13u1· arm64 · trixie-securityFixed · Fixed:
0.2.5-5pypi · rust-sudo-rs · debian · 13
- [sudo-rs]Fixed
Source package: [rust-sudo-rs]
Details (4)
0.2.5-5+deb13u1· amd64 · trixieFixed · Fixed:
0.2.5-5pypi · rust-sudo-rs · debian · 13
0.2.5-5+deb13u1· arm64 · trixieFixed · Fixed:
0.2.5-5pypi · rust-sudo-rs · debian · 13
0.2.5-5+deb13u1· amd64 · trixie-securityFixed · Fixed:
0.2.5-5pypi · rust-sudo-rs · debian · 13
0.2.5-5+deb13u1· arm64 · trixie-securityFixed · Fixed:
0.2.5-5pypi · rust-sudo-rs · debian · 13
Observed: