Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

FeedsContactPrivacy© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-96512 — Disclosure pack and PoC for CVE-2026-96512, a sudo NOTBEFORE/NOTAFTER TZ time-window bypass enabling local privilege escalation, with lab reproduction and patch guidance. | Kitploit
Tools/GitHubGitHub/abraxas/cve-2026-96512
Privilege EscalationVulnerability AnalysisExploitationSecurity VirtualizationPenetration TestingLabs & Practice
GitHubabraxas/cve-2026-96512

CVE-2026-96512

Disclosure pack and PoC for CVE-2026-96512, a sudo NOTBEFORE/NOTAFTER TZ time-window bypass enabling local privilege escalation, with lab reproduction and patch guidance.

View Repository
12812 days agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Abraxas Labs - CVE-2026-96512

abraxaslabs.tech  ·  github.com/abraxas  ·  @abraxas_null  ·  [email protected]  ·  CVE-2026-96512

CVE-2026-96512

sudo 1.9.13p3 (Debian bookworm) - Sudo Project

I am @abraxas_null. Local lab, not HTTP. The client is CVE-2026-96512-Abraxas-Labs.py.

NOTBEFORE / NOTAFTER timestamps without a trailing Z go through mktime(), which follows the caller's TZ. A local user already named in such a rule can shift the window by up to ~25 hours (TZ=UTC+14) and run the allowed command outside the intended period. PAM is unchanged. Fix is main 1820a34 (copy environ off envp, unsetenv TZ). No upstream tarball yet at disclosure.

CVECVE-2026-96512 · CVE.org
CWECWE-863
CVSSHigh: 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productsudo
Affectedall versions through 1.9.13p3 (Debian bookworm) (inclusive)
Patchedmain commit 1820a34 (no upstream release yet) and later
Authauthenticated
LicenseGNU Affero GPL v3.0
Lab127.0.0.1 only

What an attacker can do

Local PR:L. You already have a timed sudoers rule. Export TZ=UTC+14 and run the command. Root. This is not remote. A rule that still has a trailing Z is not this CVE.

How I found it

I mapped parse_gentime / gram.y timespec, then built a sudoers rule NOTAFTER=<now-1h no Z> for labuser on /usr/bin/id.

Without TZ: sudo -n id denied. With TZ=UTC+14: uid=0(root).

Fail-controls already in the lab: root without TZ means the rule is still valid (not the bug); remote network access is not this CVE; a reverse shell is not the witness.

The lab

Compose image, no published HTTP port. sudo 1.9.13p3. entrypoint.sh plants the timed rule. ./run.sh is the path.

  • lab/Dockerfile
  • lab/docker-compose.yml
  • lab/entrypoint.sh
  • lab/run.sh

Local compose, no published HTTP port.

cd lab
./run.sh

Witness: Without TZ: sudo -n id denied. With TZ=UTC+14: uid=0(root).

Ways to lose without learning anything:

  • root without TZ (rule still valid)
  • remote network access
  • reverse shell

The fix

Update sudo to main commit 1820a34 or newer (no upstream release yet at disclosure). Re-run CVE-2026-96512-Abraxas-Labs.py against the patched build: TZ=UTC+14 must stay denied.

References

  • CVE-2026-96512 · NVD

  • CVE-2026-96512 · CVE.org

  • access.redhat.com/security/cve/cve-2026-96512

  • http://www.openwall.com/lists/oss-security/2026/09/24/4

  • github.com/sudo-project/sudo/commit/1820a349687522f51023d1ae5925125f59679a8c

  • www.cve.org/CVERecord?id=CVE-2026-96512

  • access.redhat.com/security/cve/CVE-2026-96512

  • Abraxas Labs: abraxaslabs.tech · github.com/abraxas · @abraxas_null

License

GNU Affero GPL v3.0. See LICENSE.

The client talks to loopback. Using it against systems you do not own is not authorized by Abraxas Labs. No warranty.

abraxaslabs.tech · github.com/abraxas · @abraxas_null

Download Tool