The Y2K38 Bug Is a Vulnerability, Not Just a Date Problem, Researchers Warn

The Y2K38 bug, also called the Year 2036/2038 problem, is described as a vulnerability rather than a mere date problem, with researchers warning that time manipulation could be exploited today against ICS and consumer devices. They note that billions of systems rely on timekeeping, and rollover issues could trigger crashes, data corruption, or failed safety protocols, potentially affecting critical infrastructure.

Researchers Tre y Darley and Pedro Umbelino, via the Epochalypse Project, warn that threat actors do not need to wait until 2036 or 2038 to exploit these flaws and could manipulate time through methods such as GPS spoofing or NTP injection. Umbelino has identified hundreds of thousands of internet‑exposed devices potentially impacted, including servers, ICS and smart TVs, and Dover Fueling Solutions confirmed its ProGauge products are vulnerable, with CVE‑2025‑55068 enabling manual time changes.

CISA recently announced that Dover has released updates to patch several vulnerabilities in ProGauge devices. The researchers emphasise that treating the 2036/2038 rollovers as vulnerabilities—rather than bugs—offers a path for prioritisation and remediation across affected systems.