diff --git a/core/cve_metadata.c b/core/cve_metadata.c
index ab5fc80..045c908 100644
--- a/core/cve_metadata.c
+++ b/core/cve_metadata.c
@@ -236,6 +236,14 @@ const struct cve_metadata cve_metadata_table[] = {
         .in_kev              = false,
         .kev_date_added      = "",
     },
+    {
+        .cve                 = "CVE-2025-32462",
+        .cwe                 = "CWE-863",
+        .attack_technique    = "T1068",
+        .attack_subtechnique = NULL,
+        .in_kev              = false,
+        .kev_date_added      = "",
+    },
     {
         .cve                 = "CVE-2025-32463",
         .cwe                 = "CWE-829",
@@ -292,14 +300,6 @@ const struct cve_metadata cve_metadata_table[] = {
         .in_kev              = false,
         .kev_date_added      = "",
     },
-    {
-        .cve                 = "CVE-2025-32462",
-        .cwe                 = "CWE-863",
-        .attack_technique    = "T1068",
-        .attack_subtechnique = NULL,
-        .in_kev              = false,
-        .kev_date_added      = "",
-    },
 };
 
 const size_t cve_metadata_table_len =
diff --git a/docs/CVE_METADATA.json b/docs/CVE_METADATA.json
index 82583ed..44b1aaf 100644
--- a/docs/CVE_METADATA.json
+++ b/docs/CVE_METADATA.json
@@ -251,6 +251,15 @@
     "in_kev": false,
     "kev_date_added": ""
   },
+  {
+    "cve": "CVE-2025-32462",
+    "module_dir": "sudo_host_cve_2025_32462",
+    "cwe": "CWE-863",
+    "attack_technique": "T1068",
+    "attack_subtechnique": null,
+    "in_kev": false,
+    "kev_date_added": ""
+  },
   {
     "cve": "CVE-2025-32463",
     "module_dir": "sudo_chwoot_cve_2025_32463",
@@ -313,14 +322,5 @@
     "attack_subtechnique": null,
     "in_kev": false,
     "kev_date_added": ""
-  },
-  {
-    "cve": "CVE-2025-32462",
-    "module_dir": "sudo_host_cve_2025_32462",
-    "cwe": "CWE-863",
-    "attack_technique": "T1068",
-    "attack_subtechnique": null,
-    "in_kev": false,
-    "kev_date_added": ""
   }
 ]
diff --git a/docs/RELEASE_NOTES.md b/docs/RELEASE_NOTES.md
index 81a0dfa..be2dbc7 100644
--- a/docs/RELEASE_NOTES.md
+++ b/docs/RELEASE_NOTES.md
@@ -29,6 +29,13 @@ rules into `/etc/audit` legitimately needs root.
   after disclosure, NVD had not yet classified it; it is now **CWE-269**
   (Improper Privilege Management).
 
+A third, latent cause kept the gate red even after those two: when
+`sudo_host` (CVE-2025-32462) was added in v0.9.8 its record was appended to
+the *end* of `CVE_METADATA.json`, but the drift check compares the record
+list in `discover_cves()`'s sorted order — so the out-of-order entry read
+as drift regardless of its values. Regenerating via the script restores
+sorted order.
+
 Refreshed `CVE_METADATA.json`, the generated `cve_metadata.c` table, and
 `KEV_CROSSREF.md` accordingly (README + website counts updated).