CVE-2021-3156: Sudo Heap-Based Buffer Overflow Vulnerability

High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-04-06. EPSS: 100% chance of exploitation in the next 30 days.

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

Affected products

  • BeyondTrust Privilege Management For Mac: before 21.1.1 (fixed in 21.1.1)
  • BeyondTrust Privilege Management For Unix/linux: before 10.3.2-10 (fixed in 10.3.2-10)
  • Debian Debian Linux: version 9.0 only; version 10.0 only
  • Fedoraproject Fedora: version 32 only; version 33 only
  • McAfee Web Gateway: version 8.2.17 only; version 9.2.8 only; version 10.0.4 only
  • Netapp Active Iq Unified Manager: affected versions not specified
  • Netapp Cloud Backup: affected versions not specified
  • Netapp Hci Management Node: affected versions not specified
  • Netapp Oncommand Unified Manager Core Package: affected versions not specified
  • Netapp Ontap Select Deploy Administration Utility: affected versions not specified
  • Netapp Ontap Tools: version 9 only
  • Netapp Solidfire: affected versions not specified
  • Oracle Communications Performance Intelligence Center: from 10.3.0.0.0, up to and including 10.3.0.2.1; from 10.4.0.1.0, up to and including 10.4.0.3.1
  • Oracle Micros Compact Workstation 3 Firmware: version 310 only
  • Oracle Micros ES400 Firmware: from 400, up to and including 410
  • Oracle Micros Kitchen Display System Firmware: version 210 only
  • Oracle Micros Workstation 5a Firmware: version 5a only
  • Oracle Micros Workstation 6 Firmware: from 610, up to and including 655
  • Oracle Tekelec Platform Distribution: from 7.4.0, up to and including 7.7.1
  • Sudo Project Sudo: from 1.8.2, before 1.8.32 (fixed in 1.8.32); from 1.9.0, before 1.9.5 (fixed in 1.9.5); version 1.9.5 only
  • Synology Diskstation Manager: version 6.2 only
  • Synology Diskstation Manager Unified Controller: version 3.0 only
  • Synology Skynas Firmware: affected versions not specified
  • Synology VS960HD Firmware: affected versions not specified

Published 2021-01-26. Last modified 2026-06-17.