CVE-2021-3156: listed in the CISA KEV catalog CVE-2021-3156 · CVSS 7.8 HIGH · EPSS 99% · KEV 2022-04-06
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
Is CVE-2021-3156 exploited? Listed in the CISA KEV catalog on 2022-04-06. Federal remediation due 2022-04-27. Past that date by 1571 days. EPSS puts exploitation in the next 30 days at 99%. Public exploit code: packaged in a public tool. Which products and versions are affected? No affected package list recorded here yet.
Is there a patch? No patch identifier recorded here yet.
What PlainSec published about CVE-2021-3156 Primary sources What this record does not say No affected package data. No patch identifier. KEV and EPSS are re-checked daily. Record last updated 2026-08-15.
CVE-2021-3156: listed in the CISA KEV catalog CVE-2021-3156 · CVSS 7.8 HIGH · EPSS 99% · KEV 2022-04-06
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
Is CVE-2021-3156 exploited? Listed in the CISA KEV catalog on 2022-04-06. Federal remediation due 2022-04-27. Past that date by 1571 days. EPSS puts exploitation in the next 30 days at 99%. Public exploit code: packaged in a public tool. Which products and versions are affected? No affected package list recorded here yet.
Is there a patch? No patch identifier recorded here yet.
What PlainSec published about CVE-2021-3156 Primary sources What this record does not say No affected package data. No patch identifier. KEV and EPSS are re-checked daily. Record last updated 2026-08-15.