CVE-2010-1646: Todd Miller Sudo

Medium severity, CVSS 6.2. EPSS: 0.5% chance of exploitation in the next 30 days.

The secure path feature in env.c in sudo 1.3.1 through 1.6.9p22 and 1.7.0 through 1.7.2p6 does not properly handle an environment that contains multiple PATH variables, which might allow local users to gain privileges via a crafted value of the last PATH variable.

Affected products

• Todd Miller Sudo: version 1.3.1 only; version 1.6 only; version 1.6.1 only; version 1.6.2 only; version 1.6.2p1 only; version 1.6.2p2 only; …

Published 2010-06-07. Last modified 2026-06-16.