https://seclists.org/oss-sec/2026/q3/919: CVE-2026-96512: sudo: TZ still affects NOTBEFO/NOTAFTER
Affected Software
Frequently Asked Questions
Who can exploit this issue?
A local user subject to a sudoers rule with NOTBEFORE or NOTAFTER timestamps can exploit it by controlling their TZ environment variable. Authentication is still required; the flaw affects the rule's time validation rather than authentication itself.
Which sudoers rules are vulnerable?
Rules are affected when their NOTBEFORE or NOTAFTER timestamp does not end with Z. Such timestamps are parsed using mktime(), which can be influenced by the calling user's TZ setting.
How much can the allowed time window be shifted?
An attacker can set TZ to an extreme offset and shift the effective time window by almost 25 hours. This can allow an expired rule to remain usable or a future rule to become usable early.
What can be done before an updated sudo release is available?
Use UTC timestamps with a trailing Z for NOTBEFORE and NOTAFTER values in sudoers rules. The fix is in the main branch, but no release containing it was available in the provided information.
What versions are affected?
Affected versions are sudo 1.8.20 through 1.9.17p2, as well as the main branch before the fix. The issue was tested on glibc and musl.