sudo EUVD-2026-85290

Requires all of: (1) a local unprivileged account on the host; (2) a sudoers configuration that uses NOTBEFORE or NOTAFTER time-based access restrictions; (3) those timestamps written WITHOUT the trailing 'Z' UTC indicator, so evaluation falls back to the inherited TZ environment variable; and (4) the account being subject to such a time-windowed rule. Limiting factors: exploitation is local only (AV:L, no remote path), the attacker must already be an authorized sudoers user (PR:L), and the vulnerable time-restriction syntax is a non-default, relatively rare sudoers feature - default sudo deployments without NOTBEFORE/NOTAFTER rules are not affected. Impact is bounded to shifting the authorization window by up to ~25 hours; it does not grant new commands the user was never authorized for at any time.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 HIGH) reflects a local, low-complexity, authenticated privilege-boundary issue with full triad impact. However, this raw score materially overstates real-world risk because the flaw is tightly gated: it only manifests when sudoers rules use NOTBEFORE or NOTAFTER time-based restrictions AND those timestamps omit the trailing 'Z' UTC indicator - a non-default, uncommon configuration. The impact is not authentication bypass and not unconditional privilege escalation; per the description, 'Authentication is not bypassed; only the time-based authorization check is affected.' The C:H/I:H/A:H rating is defensible only insofar as the affected time-restricted rule would grant root command execution once the ~25-hour window shift is applied. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so this is 'no public exploit identified at time of analysis.' SSVC data is not provided. Signals are consistent (local vector matches a setuid-root TZ-inheritance flaw), so there is no CVSS-vs-description conflict - but the missing exploitation-probability signals combined with the narrow configuration prerequisite indicate this is a genuine-but-low-urgency fix rather than an emergency: patch on normal cadence unless you specifically deploy time-windowed sudoers rules with non-Z timestamps.

On a system whose sudoers grants a user time-limited root command access via NOTBEFORE/NOTAFTER with timestamps lacking a trailing 'Z', an unprivileged local user whose window has expired sets TZ to an extreme offset (e.g. TZ=Etc/GMT+14 or similar) before invoking sudo. Because sudo is setuid-root and inherits the caller's TZ, the time-based check shifts by up to ~25 hours, treating the expired rule as still valid and letting the user run the otherwise-out-of-window command. No public exploit code is identified, but the technique is trivial (single environment-variable set) once the vulnerable sudoers configuration exists.