Environment Variable Weakness Undermines Scheduled Privilege Boundaries

A newly disclosed high-severity weakness in Sudo can allow local Linux users to execute privileged commands outside administrator-defined time windows by manipulating the timezone environment inherited by the utility.


Tracked as CVE-2026-96512, the issue affects Sudo versions 1.8.20 through 1.9.17p2 and carries a CVSS score of 7.8.


Unlike conventional privilege-escalation bugs, the weakness does not automatically grant root permissions to an ordinary account.

Instead, it targets Sudo's NOTBEFORE and NOTAFTER policy controls, potentially allowing an already authorized user to activate privileges early or continue using them after they should have expired.


User-Controlled Timezone Alters Policy Decisions

Sudoers administrators can assign time boundaries to privileged commands.


The vulnerability appears when those timestamps do not specify an explicit timezone, such as UTC using a trailing Z or a numerical UTC offset.


Internally, Sudo's parse_gentime() function relies on the standard C library function mktime() to interpret these timestamps.


The security problem arises because mktime() considers the process's TZ environment variable.


Since a local user can control that variable before invoking Sudo, a specially selected POSIX timezone value can alter the effective time Sudo uses when determining whether a restricted privilege is currently valid.


Authorization Window Can Shift by Nearly 25 Hours

Researcher Ermenson Junior, who reported the issue, demonstrated that extreme timezone offsets can move the effective authorization window by almost 25 hours in either direction.
That creates two significant scenarios.


A NOTAFTER permission that has already expired can potentially appear valid again, while a NOTBEFORE permission scheduled for the future can become available before its intended activation time.


The technique was reportedly reproduced against both glibc and musl, showing that the issue is not limited to a single common C library implementation.


Authentication Remains Intact

This distinction is critical when evaluating the severity of CVE-2026-96512.


The vulnerability does not bypass PAM authentication, nor does it allow an arbitrary local account with no sudo authorization to suddenly execute privileged commands.
The attacker must already possess a sudoers rule governed by the affected time restrictions.


What fails is the temporal authorization boundary around that existing permission.


That makes environments using temporary administrative privileges, maintenance windows, emergency-access policies or automatically expiring sudo rules particularly relevant to the vulnerability.


Source Fix Exists, but Configuration Also Matters

The affected functionality was introduced with Sudo 1.8.20.
The issue was reported on August 28, 2026, and an upstream correction was committed shortly afterward. At the time of the public disclosure, however, the fix had not yet appeared in a new upstream Sudo release.


Administrators should follow security updates from their Linux distribution rather than relying exclusively on the upstream version number.


A practical configuration-level mitigation is also available: timestamps used with NOTBEFORE and NOTAFTER can be written with an explicit timezone, particularly a trailing Z for UTC, preventing the user's TZ environment from influencing their interpretation.


Small Parsing Decisions Can Break Privilege Boundaries


CVE-2026-96512 demonstrates how privilege-management security depends on more than passwords and command allowlists.


Sudo is a setuid-root security boundary, meaning apparently minor interactions between privileged code, inherited environment variables and standard system libraries require careful treatment.


In this case, attackers do not need to corrupt memory, exploit the kernel or defeat authentication.
They instead influence Sudo's perception of time.


For security teams, the lesson is particularly relevant to temporary-access architectures: an authorization policy is only as reliable as every input used to evaluate it.

 When attacker-controlled environmental state can influence that decision, an expired privilege may no longer be truly expired.