{"cve":"CVE-2021-3156","nvd":{"published":"2021-01-26T21:15:12.987","modified":"2026-06-17T04:04:45.830","status":"Analyzed","description":"Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via \"sudoedit -s\" and a command-line argument that ends with a single backslash character.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-193"],"references":["http://packetstormsecurity.com/files/161160/Sudo-Heap-Based-Buffer-Overflow.html","http://packetstormsecurity.com/files/161230/Sudo-Buffer-Overflow-Privilege-Escalation.html","http://packetstormsecurity.com/files/161270/Sudo-1.9.5p1-Buffer-Overflow-Privilege-Escalation.html","http://packetstormsecurity.com/files/161293/Sudo-1.8.31p2-1.9.5p1-Buffer-Overflow.html","http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html"],"products":["beyondtrust:privilege_management_for_mac","beyondtrust:privilege_management_for_unix\\/linux","debian:debian_linux","fedoraproject:fedora","mcafee:web_gateway","netapp:active_iq_unified_manager","netapp:cloud_backup","netapp:hci_management_node","netapp:oncommand_unified_manager_core_package","netapp:ontap_select_deploy_administration_utility","netapp:ontap_tools","netapp:solidfire","oracle:communications_performance_intelligence_center","oracle:micros_compact_workstation_3_firmware","oracle:micros_es400_firmware","oracle:micros_kitchen_display_system_firmware","oracle:micros_workstation_5a_firmware","oracle:micros_workstation_6_firmware","oracle:tekelec_platform_distribution","sudo_project:sudo","synology:diskstation_manager","synology:diskstation_manager_unified_controller","synology:skynas_firmware","synology:vs960hd_firmware"],"source":"nvd","synced_at":"2026-10-19T21:14:10.479542811+00:00"},"epss":{"cve":"CVE-2021-3156","score":0.99962,"percentile":0.99976,"date":"2026-10-31"},"kev":{"cve":"CVE-2021-3156","date_added":"2022-04-06","due_date":"2022-04-27","vendor":"Sudo","product":"Sudo","known_ransomware":false},"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}