CVE-2026-102484
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the Telephone JJY time source to corrupt memory or crash ntpd via more than six time replies.
Risk Assessment
This can lead to a crash of the time synchronization service or potential code execution if an attacker controls the JJY time source. Disruption of NTP may affect time integrity within the organization.
Recommendation
Upgrade NTPsec to version 1.2.6 or later. Limit trust in external time sources and monitor for unusual replies from time servers.
Other vulnerabilities in NTPsec
See all- CVE-2026-121506High
An out-of-bounds read and write in NTS client extension field parsing (extens_client_recv) in NTPsec before 1.2.5 allows a remote attacker who can send NTP server-mode replies to an NTS client to corrupt heap memory and crash ntpd, and, combined with the NTS-KE client out-of-bounds read fixed in 1.2.4, to bypass NTS authentication and set the client's time.
- CVE-2026-121505Low
An out-of-bounds read in the NTS-KE client response parser (nts_client_process_response_core) in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the client then sends in cleartext as NTS cookies, via an NTS-KE record whose declared length exceeds the data received.
- CVE-2026-18321Medium
In NTPsec, a buffer overflow in the Zyfer reference clock driver allows a local attacker to crash the ntpd process.
Original NVD description (English source)
Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the Telephone JJY time source to corrupt memory or crash ntpd via more than six time replies.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS