abraxas/cve-2026-96512Disclosure pack and PoC for CVE-2026-96512, a sudo NOTBEFORE/NOTAFTER TZ time-window bypass enabling local privilege escalation, with lab reproduction and patch guidance.
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · CVE-2026-96512
sudo 1.9.13p3 (Debian bookworm) - Sudo Project
I am @abraxas_null. Local lab, not HTTP. The client is CVE-2026-96512-Abraxas-Labs.py.
NOTBEFORE / NOTAFTER timestamps without a trailing Z go through mktime(), which follows the caller's TZ. A local user already named in such a rule can shift the window by up to ~25 hours (TZ=UTC+14) and run the allowed command outside the intended period. PAM is unchanged. Fix is main 1820a34 (copy environ off envp, unsetenv TZ). No upstream tarball yet at disclosure.
| CVE | CVE-2026-96512 · CVE.org |
| CWE | CWE-863 |
| CVSS | High: 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Product | sudo |
| Affected | all versions through 1.9.13p3 (Debian bookworm) (inclusive) |
| Patched | main commit 1820a34 (no upstream release yet) and later |
| Auth | authenticated |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1 only |
Local PR:L. You already have a timed sudoers rule. Export TZ=UTC+14 and run the command. Root. This is not remote. A rule that still has a trailing Z is not this CVE.
I mapped parse_gentime / gram.y timespec, then built a sudoers rule NOTAFTER=<now-1h no Z> for labuser on /usr/bin/id.
Without TZ: sudo -n id denied. With TZ=UTC+14: uid=0(root).
Fail-controls already in the lab: root without TZ means the rule is still valid (not the bug); remote network access is not this CVE; a reverse shell is not the witness.
Compose image, no published HTTP port. sudo 1.9.13p3. entrypoint.sh plants the timed rule. ./run.sh is the path.
Local compose, no published HTTP port.
cd lab
./run.sh
Witness: Without TZ: sudo -n id denied. With TZ=UTC+14: uid=0(root).
Ways to lose without learning anything:
Update sudo to main commit 1820a34 or newer (no upstream release yet at disclosure). Re-run CVE-2026-96512-Abraxas-Labs.py against the patched build: TZ=UTC+14 must stay denied.
github.com/sudo-project/sudo/commit/1820a349687522f51023d1ae5925125f59679a8c
Abraxas Labs: abraxaslabs.tech · github.com/abraxas · @abraxas_null
GNU Affero GPL v3.0. See LICENSE.
The client talks to loopback. Using it against systems you do not own is not authorized by Abraxas Labs. No warranty.