A failure of the setuid, setgid, or setgroups system call during a privilege‑dropping step before the mailer is executed means the error is ignored and the process can continue with elevated privileges. This flaw allows a non‑root user who can invoke the mailer to retain root rights, granting the attacker full system control. The weakness aligns with authorization and privilege‑dropping errors, reflected by CWE‑271 and CWE‑272.

The vulnerability affects all releases of the Sudo project through version 1.9.17p2 prior to the commit 3e474c2. Any system running that version of Sudo and with the mailer feature enabled is vulnerable.

The CVSS score of 7.4 indicates a high impact, but the EPSS score of less than 1% suggests a low probability of exploitation in the wild. Because the flaw is triggered by attempting to drop privileges during mailer execution, the attack vector is most likely local, requiring the ability to run a command via sudo that invokes the mailer. The issue is not listed in the CISA KEV catalog and no public exploit has been reported; however, an attacker with local sudo access can immediately gain root privileges if the flaw is present.