CVE-2026-102486
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS Authenticator and Encrypted Extension Fields (AEEF) field with an oversized nonce length.
Risk Assessment
This can cause a denial of service for time synchronization, potentially affecting other systems relying on NTP.
Recommendation
Update NTPsec to a version later than 1.2.5.
Other vulnerabilities in NTPsec ntpd
See all- CVE-2026-102485Medium
Out-of-bounds read in the Motorola Oncore refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the GPS receiver's serial data to crash ntpd or disclose memory via a PPS Control (@@Gc) reply with an out-of-range mode byte.
- CVE-2026-102483High
Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request with excess NTS Cookie Placeholder extension fields.
Original NVD description (English source)
Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS Authenticator and Encrypted Extension Fields (AEEF) field with an oversized nonce length.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS