Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enforcement and logging.

CVE-2026-82474 affects Sudo through version 1.9.17p2, where ptrace-based intercept mode fails to apply policy checks to the execveat system call. This allows users who are permitted to run specific commands to execute otherwise denied programs by calling execveat directly or via fexecve. The bypass circumvents both policy enforcement and logging mechanisms, representing a significant privilege escalation risk. The vulnerability exists in the exec_ptrace.c source file of the sudo-project. A patch has been committed to the official sudo repository to address this flaw. Organizations relying on Sudo's intercept mode for command restrictions are directly impacted. The issue highlights a gap in system call coverage within sudo's security enforcement layer.