A flaw in sudo allows an unprivileged local user to set the TZ environment variable to an extreme offset when sudoers rules use NOTBEFORE or NOTAFTER timestamps lacking a trailing 'Z'. Because the setuid-root sudo process interprets these times relative to the inherited TZ, an attacker can shift the authorization window by up to approximately 25 hours, treating expired rules as still valid. This bypass lets the user run commands outside the intended time window, effectively granting them elevated privileges for a period that should have been forbidden, although the authentication mechanism itself remains intact.

The vulnerability impacts Red Hat Enterprise Linux versions 10, 9, 8, and 7 as well as the Red Hat Hardened Images (Hummingbird) distribution. All systems running sudo with time‑based restrictions in their sudoers files without a 'Z' suffix on the timestamps are at risk, regardless of the specific sudo version installed.

With a CVSS score of 7.8, the flaw represents a high severity vulnerability. The EPSS score is not available, but the simplicity of setting TZ and the local nature of the attack make exploitation likely in compromised environments. Although the vulnerability is not currently cataloged in CISA KEV, its potential for local privilege escalation warrants immediate attention. An attacker only needs local shell access to set TZ before invoking sudo; no remote privileges are required.