~ / topics / Testing & Remediation
$man risk-assessment-checklist

Risk Assessment Checklist

In brief: This page is for risk, audit, compliance and procurement teams. It explains how to find out which of your systems might break around 19 January 2038, how to rank them, what to ask suppliers and what to write into contracts. It also lists the official guidance that exists today. As of 2026-10-21, no major government cyber agency has published dedicated Year 2038 guidance, so organisations have to build their own programme.

Risk level High (organisation-wide; driven by embedded/OT and long-lived data)
Status No regulatory mandate found; vendor advisories began appearing in 2025
Last reviewed 2026-10-21

Overview

Treat Year 2038 as a vulnerability class, not only as a date. Since 2025, US CISA and Germany's CERT@VDE have published 2038 overflows as ordinary CVEs classified CWE-190, "Integer Overflow or Wraparound", in fuel-tank gauges and industrial controllers [1][2][3][4]. Several of those advisories say an attacker can trigger the failure today by changing the device's clock. In some cases a low-privileged user is enough [1][3][4]. Researchers have described GPS spoofing and NTP manipulation as ways to do this [5][6].

There are also two kinds of deadline:

Kaspersky's 2026 guidance recommends:

Bitsight's 2026 internet survey estimated large exposed populations of 32-bit systems, including roughly 500,000 reachable Boa web servers and thousands of automatic tank gauges [8].

1. Inventory checklist

Record one line per asset. Mark each item Y / N / Unknown. "Unknown" counts as "Y" for triage.

Platform

Software

Data

Time sources and interfaces

Lifecycle and ownership

2. Triage matrix (likelihood × impact)

Likelihood (choose the highest that applies):

Score Criterion
5 – Confirmed Vendor advisory/CVE, failed future-date test, or scan finds 32-bit time APIs
4 – Likely 32-bit platform with Linux < 5.6, or glibc built without time64, or 32-bit Windows; no vendor statement
3 – Possible 64-bit platform, but app/DB/format uses 32-bit fields, or status unknown
2 – Unlikely Vendor attests 2038-safe and the attestation has been spot-tested
1 – Rare Fully 64-bit stack, tested past 2038 and 2106

Impact (choose the highest):

Score Criterion
5 – Severe Safety, life-critical, or critical-infrastructure function; regulatory breach
4 – Major Revenue-critical service outage; financial misstatement; data corruption
3 – Moderate Degraded operations; manual workaround exists
2 – Minor Logs or reports wrong; cosmetic
1 – Negligible No business effect

Risk = L × I

L \ I 1 2 3 4 5
5 5 Med 10 High 15 High 20 Crit 25 Crit
4 4 Low 8 Med 12 High 16 Crit 20 Crit
3 3 Low 6 Med 9 Med 12 High 15 High
2 2 Low 4 Low 6 Med 8 Med 10 High
1 1 Low 2 Low 3 Low 4 Low 5 Med

Add +1 likelihood if an untrusted party can set the clock, since early triggering is documented in CVE-2025-55067/55068 and CVE-2025-0101 [1][2][3]. Add +1 impact if the asset cannot be patched and needs physical replacement. Bitsight estimated that replacing about 50,000 automatic tank gauges would cost roughly US$1–1.8 billion and take 3–6 years [8].

3. Questions to ask vendors

  1. Is the product (hardware, firmware, OS, libraries, application and cloud back end) able to represent and process dates after 2038-01-19 03:14:07 UTC and after 2106-02-07 06:28:15 UTC?
  2. What is the width of time_t in each component? For Linux products: kernel version, C library and version, and whether _TIME_BITS=64 is used.
  3. Which on-disk, database and wire formats contain time fields, and how wide are they?
  4. Have you tested with the system clock set past 2038 and with future-dated data? Please share the test report.
  5. What happens on rollover: crash, lockout, wrong dates, or safe degradation?
  6. Can an unauthenticated or low-privileged user, NTP or GNSS input change the device clock?
  7. Is any "unsigned" or "epoch-shift" workaround in use, and when does it expire?
  8. Is a fix released or planned? Give version numbers and dates. Will it be delivered to installed units in the field?
  9. What is the product's end-of-support date, and will 2038 fixes reach units still in service?
  10. Can you provide an SBOM listing the libc, the RTOS, and any third-party time or date libraries?

4. Contract and procurement language

Sample wording for counsel to adapt. This is not legal advice.

Date-handling warranty. Supplier warrants that the Deliverables shall correctly create, store, process, compare, display and exchange date and time values from 1970-01-01 through at least 2106-12-31. This includes, without limitation, correct operation across 2036-02-07 (NTP era), 2038-01-19 03:14:08 UTC (signed 32-bit Unix time) and 2038-11-20 (GPS week rollover). Supplier shall use time representations of at least 64 bits for absolute times.

Testing and evidence. Before acceptance and upon Customer's request, Supplier shall provide test evidence showing correct operation with the system clock set to dates after 2038-01-19 and with data containing such dates.

Disclosure. Supplier shall notify Customer within 30 days of becoming aware of any time-representation defect (including CWE-190 defects in time handling) affecting the Deliverables. Supplier shall also provide a remediation plan and timeline.

Clock integrity. The Deliverables shall not permit unauthenticated or low-privileged changes to the system clock and shall support authenticated time synchronisation.

Support horizon. Where the expected service life extends beyond 2038, Supplier shall provide date-handling fixes for the full expected service life, or offer a no-cost replacement path.

The Packet Pushers "Heavy Strategy" episode of June 2025 also recommends adding Epochalypse requirements to procurement and M&A due diligence and escalating to the board [17].

5. Timeline counting back from 2038

Dates in bold are fixed technical events. The others are recommended programme milestones.

When Milestone
Already passed Systems calculating dates more than ~11 years ahead now cross 2038. First field failure documented in 2006 (AOLserver) [18]; see Known-2038-Incidents
2026 Q4–2027 Q2 Inventory complete; owners named; vendor questionnaires sent; new purchases must comply with the 2038 clauses
2027 Q3–2028 Triage complete; Critical/High items have funded plans; replacement budgets set for unpatchable devices
2028–2033 Remediation and replacement waves, about 5 years. OT replacement can take several years [8][17]
2034–2035 Full end-to-end future-clock tests; contingency plans written
2036-02-07 06:28:16 UTC NTP era 0 → era 1 rollover [15]
2037 Change freeze on time-critical systems. A museum PDP-11 test found a crash at the start of 2037, a year early [19]
2038-01-19 03:14:08 UTC Signed 32-bit Unix time overflows
2038-11-20 Legacy GPS 10-bit week rollover [16]
2106-02-07 06:28:15 UTC Last second representable in unsigned 32-bit Unix time (overflow at 06:28:16); affects "unsigned" fixes (see Year-2106-and-Beyond)

6. Relevant standards and guidance

Body Item 2038-specific?
CISA (US) ICS advisories ICSA-25-261-07 (Dover ProGauge, CVE-2025-55068) and ICSA-25-296-03 (Veeder-Root TLS4B, CVE-2025-55067) [1][2] Yes, but product-specific advisories, not programme guidance
CISA (US) Time Guidance for Network Operators, CIOs, CISOs (revised 2020-12-17) [20] No 2038 mention found on the landing page; useful for time-source integrity
DHS/NCCIC (US) 2019 GPS week rollover memo for owners and operators [21] No, but an analogous rollover
CERT@VDE (DE) VDE-2025-007 (WAGO controllers, CVE-2025-0101), VDE-2025-020 (WAGO switches, CVE-2025-1235) [3][4] Yes, product-specific
NIST (US) — No 2038 publication found (searched 2026-10-21)
ENISA (EU) — No 2038 publication found (searched 2026-10-21)
UK NCSC — No 2038 publication found (searched 2026-10-21)
POSIX / The Open Group Austin Group issue 1462: time_t must be at least 64 bits wide (Issue 8 / POSIX.1-2024) [22] Yes, a technical standard
Epochalypse Project Community FAQ stating there is "no mandate, no inventory requirement, no body on point" for 2038 [23] Yes, community
FOSDEM 2026 BoF "2038-Class Risk Exposure Matrix" for open-source triage (CC BY 4.0) [24] Yes, community

Reports that ITU-T Study Group 17 is preparing a 2038 technical paper appear in search snippets, but they could not be confirmed from a primary source. (unverified)

For the Y2K governance precedent, see Y2K-Remediation-and-Cost and Y2K-Lessons-for-2038. In 1999, GAO found that only 7 of 24 major US federal agencies tracked actual Y2K costs separately [25]. Set up cost tracking from the start.

Risk & compliance notes

Detection & mitigation

Technical detection is covered in Testing-and-Detection. Fixes by layer are in Remediation-Guide.

See also

References

  1. ICSA-25-261-07 Dover Fueling Solutions ProGauge MagLink LX4 Devices — CISA, 2025-09-18 — CVE-2025-55068, Unix-time overflow triggerable by changing system time.
  2. ICSA-25-296-03 Veeder-Root TLS4B Automatic Tank Gauge System — CISA, 2025-10-23 — CVE-2025-55067, wrap to 1901, DoS via time manipulation.
  3. VDE-2025-007 WAGO: Year 2038 problem — CERT@VDE, 2025-04-15 — CVE-2025-0101, low-privileged user can trigger.
  4. VDE-2025-020 WAGO: Switches affected by year 2k38 problem — CERT@VDE, 2025-06-02 — CVE-2025-1235.
  5. 2038 is gonna be epoch! — Hack.lu 2025, 2025-10-23 — Umbelino and Darley on 2038 failure modes in IoT/ICS.
  6. The Y2K38 Bug Is a Vulnerability, Not Just a Date Problem, Researchers Warn — SecurityWeek — GPS spoofing/NTP injection as early triggers (seen in search results).
  7. Epochalypse Now — or how to deal with Y2K38 — Kaspersky, 2026-01-19 — organisational programme steps.
  8. Forward to the Past: The Y2K38 Problem Ahead — Bitsight, 2026-01-18 — exposure estimates and replacement costs.
  9. Linux 5.6 Is The First Kernel For 32-Bit Systems Ready To Run Past Year 2038 — Phoronix, 2020-01-29 — kernel baseline.
  10. GNU C Library 2.34 released — LWN, 2021-08-01 — glibc baseline.
  11. musl 1.2.0 released — Openwall musl list, 2020-02-21 — musl baseline.
  12. ReleaseGoals/64bit-time — Debian Wiki — i386 excluded.
  13. gmtime, _gmtime32, _gmtime64 — Microsoft Learn — 32-bit CRT time limits.
  14. The DATE, DATETIME, and TIMESTAMP Types — MySQL 8.0 Reference Manual — TIMESTAMP range.
  15. The NTP Era and Era Numbering — D. L. Mills — 2036 era transition.
  16. Time formatting and storage bugs — Wikipedia — GPS rollover 2038-11-20 (citing GPS.gov).
  17. HS106: Planning for the Epochalypse — Packet Pushers Heavy Strategy, 2025-06-17 — procurement, M&A, board escalation.
  18. First known Y2038 bug (AOLserver) — Justin Mason, 2006-07-20 — 2006 failure.
  19. The Unix Epochalypse might be sooner than you think — The Register, 2025-08-23 — TNMOC PDP-11/73 fails in 2037.
  20. Time Guidance for Network Operators, CIOs, CISOs — CISA (rev. 2020-12-17) — time integrity guidance.
  21. Homeland Security provides info about 2019 GPS rollover event — GPS World — DHS memo for owners/operators (seen in search results).
  22. Austin Group issue 0001462 — Require (at least) 64-bit time_t — POSIX requirement.
  23. FAQ — The Epochalypse Project (updated 2026-07-09) — "no mandate" observation.
  24. Pulling 32-bit time_t Asbestos out of the Open Source Ecosystem — FOSDEM 2026, 2026-01-31 — risk exposure matrix.
  25. Year 2000 Computing Crisis: Costs and Planned Use of Emergency Funds — GAO/AIMD-99-154, 1999 — Y2K cost tracking finding.