CVE-2026-102485
MediumCVSS 5.2Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Out-of-bounds read in the Motorola Oncore refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the GPS receiver's serial data to crash ntpd or disclose memory via a PPS Control (@@Gc) reply with an out-of-range mode byte.
Risk Assessment
An attacker could cause a denial of service (ntpd crash) or memory disclosure, potentially affecting time synchronization and security.
Recommendation
Update NTPsec ntpd to version 1.2.6 or later. Restrict physical and network access to the GPS receiver.
Other vulnerabilities in NTPsec ntpd
See all- CVE-2026-102486High
Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS Authenticator and Encrypted Extension Fields (AEEF) field with an oversized nonce length.
- CVE-2026-102483High
Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request with excess NTS Cookie Placeholder extension fields.
Original NVD description (English source)
Out-of-bounds read in the Motorola Oncore refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the GPS receiver's serial data to crash ntpd or disclose memory via a PPS Control (@@Gc) reply with an out-of-range mode byte.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS