CVE-2026-96512

Name of the Vulnerable Software and Affected Versions sudo (affected versions not specified)

Description A flaw exists in the evaluation of time-based access restrictions in sudoers rules. When NOTBEFORE or NOTAFTER timestamps omit the trailing 'Z' timezone indicator, the system relies on the TZ environment variable inherited from the calling user. Since sudo is a setuid-root program, an unprivileged local user can manipulate the TZ variable to shift the authorization window by approximately 25 hours. This allows the execution of commands outside the intended time window by making expired rules appear valid. This issue affects time-based authorization checks but does not bypass authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.