I don't know if you noticed, but sudo has many CVE's since it existed, for such a small target (executing with root).