CVE-2026-96512: sudo, local time-window bypass

Timestamps without a trailing Z go through mktime, which follows the caller TZ. A local user already named in that rule can shift the window by about 25 hours and run the allowed command outside the intended period.

Name: CVE-2026-96512: sudo, local time-window bypass
Type: N-day analysis
CVE: CVE-2026-96512
CVE Risk: high
Disclosure Status: public
Vendor: Sudo Project
Affected: sudo 1.9.13p3 as shipped in Debian bookworm, when a sudoers rule uses NOTBEFORE or NOTAFTER without a trailing Z. Fix is main commit 1820a34. No upstream tarball at disclosure.
Published: 28 Oct 2026
Updated: 28 Oct 2026
Tags: n-day, sudo, cwe-863

sudo, local time-window bypass

sudo 1.9.13p3 (Debian bookworm) - Sudo Project

I am @abraxas_null. Local lab, not HTTP. The client is CVE-2026-96512-Abraxas-Labs.py.

NOTBEFORE / NOTAFTER timestamps without a trailing Z go through mktime(), which follows the caller's TZ. A local user already named in such a rule can shift the window by up to ~25 hours (TZ=UTC+14) and run the allowed command outside the intended period. PAM is unchanged. Fix is main 1820a34 (copy environ off envp, unsetenv TZ). No upstream tarball yet at disclosure.

CVE-2026-96512 (NVD). CWE-863. Vendor: Sudo Project. sudo 1.9.13p3 as shipped in Debian bookworm, when a sudoers rule uses NOTBEFORE or NOTAFTER without a trailing Z. Fix is main commit 1820a34. No upstream tarball at disclosure.

What an attacker can do

Local PR:L. You already have a timed sudoers rule. Export TZ=UTC+14 and run the command. Root. This is not remote. A rule that still has a trailing Z is not this CVE.

How this showed up in the lab

I mapped parse_gentime / gram.y timespec, then built a sudoers rule NOTAFTER=<now-1h no Z> for labuser on /usr/bin/id.

Without TZ: sudo -n id denied. With TZ=UTC+14: uid=0(root).

Fail-controls already in the lab: root without TZ means the rule is still valid (not the bug); remote network access is not this CVE; a reverse shell is not the witness.

The lab

Compose image, no published HTTP port. sudo 1.9.13p3. entrypoint.sh plants the timed rule. ./run.sh is the path.

Local compose, no published HTTP port.

Plain text

cd lab
./run.sh