Sudo CVE-2026-96512 can shift time-based rules

Local sudo flaw CVE-2026-96512 lets TZ shift time-based sudoers windows by about 25 hours; the fix is committed but unreleased.

CVE-2026-96512, called high severity by GBHackers and Cyber Security News, affects Sudo 1.8.20 through 1.9.17p2 and lets a local user influence sudoers NOTBEFORE and NOTAFTER checks through TZ. When a rule timestamp lacks a trailing Z, parse_gentime() uses mktime(), which reads TZ; an earlier commit fixed only localtime_r(). Sources agree an extreme value such as TZ=XXX24 can shift the window by about 25 hours, while oss-security says almost 25 hours. Exploitation requires an existing time-restricted sudoers rule and does not bypass passwords or PAM, although Cyber Security News frames it as privilege escalation. Ermenson Junior reported the bug on August 28, 2026, and Todd Miller committed a fix the next day (1820a349687522f51023d1ae5925125f59679a8c) that removes TZ before timezone setup; it was not yet in a released package, including Sudo 1.9.18. Red Hat tracks Bug 2539327, and the reports do not describe remote or in-the-wild exploitation.

• CVE-2026-96512 is described as high severity and affects Sudo 1.8.20 through 1.9.17p2.
• If a sudoers timestamp has no trailing Z, parse_gentime() uses mktime(), which honors the caller's TZ; an earlier fix covered only localtime_r().
• A local user can set an extreme offset such as TZ=XXX24 and move NOTBEFORE/NOTAFTER windows by about 25 hours (oss-security says almost 25 hours).
• The bug needs an existing time-restricted sudoers rule and does not bypass passwords or PAM.
• Ermenson Junior reported it on August 28, 2026; Todd Miller committed a fix the next day (1820a349687522f51023d1ae5925125f59679a8c) that removes TZ before timezone setup.
• That fix was not yet in a released Sudo version, including 1.9.18.
• Red Hat tracks the issue as Bug 2539327; reports do not describe remote or in-the-wild exploitation.