CVE-2026-96512: sudo: TZ still affects NOTBEFORE/NOTAFTER
Sudo CVE-2026-96512 lets a local user shift sudoers time windows by abusing TZ.
CVE-2026-96512 was assigned to a sudo bug in which the calling user's TZ variable still affects NOTBEFORE and NOTAFTER checks in sudoers. If the rule timestamp has no trailing Z, parse_gentime() uses mktime(), which reads TZ; an earlier commit fixed only localtime_r(). A local user can set an extreme offset and move the time window by almost 25 hours. The report does not describe remote or in-the-wild exploitation.
- Caller TZ still affects sudoers NOTBEFORE and NOTAFTER checks
- parse_gentime() uses mktime() when the timestamp has no trailing Z
- An earlier fix covered localtime_r() but left mktime() reachable
- A local user can shift the allowed window by almost 25 hours
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-96512 | Time-window bypass via TZ manipulation in sudo NOTBEFORE/NOTAFTER rules | 7.8 | <1% | PoC ×2 |
From the original article
Posted by Ermenson Junior on Sep 24 Hi, CVE-2026-96512 was assigned to a sudo bug where TZ from the calling user still affects NOTBEFORE/NOTAFTER checks in sudoers. If the timestamp in the rule has no trailing Z, parse_gentime() uses mktime(), which reads TZ again. Commit db669167c fixed an earlier report of this (no CVE, not mine) but only covered localtime_r(), so mktime() was still reachable.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.