Oof, I'm surprised sudo has lasted this long without serious inspection and fuzzing that should've caught this. Given its sensitive nature and low complexity, I'd say this utility is a high priority for being rewritten in rust.
If you tell rust to do silly things it will still do silly things. The “fix” for this is less complexity, like doas. Sudo is a ridiculously complex program