CVE-2026-121505
LowCVSS 3.7Summary
An out-of-bounds read in the NTS-KE client response parser (nts_client_process_response_core) in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the client then sends in cleartext as NTS cookies, via an NTS-KE record whose declared length exceeds the data received.
Risk Assessment
A malicious NTS-KE server can obtain client memory information and bypass ASLR, potentially facilitating further attacks and undermining time synchronization security.
Recommendation
Update NTPsec to version 1.2.4 or later.
Other vulnerabilities in NTPsec
See all- CVE-2026-121506High
An out-of-bounds read and write in NTS client extension field parsing (extens_client_recv) in NTPsec before 1.2.5 allows a remote attacker who can send NTP server-mode replies to an NTS client to corrupt heap memory and crash ntpd, and, combined with the NTS-KE client out-of-bounds read fixed in 1.2.4, to bypass NTS authentication and set the client's time.
- CVE-2026-102484Medium
Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the Telephone JJY time source to corrupt memory or crash ntpd via more than six time replies.
- CVE-2026-18321Medium
In NTPsec, a buffer overflow in the Zyfer reference clock driver allows a local attacker to crash the ntpd process.
Original NVD description (English source)
An out-of-bounds read in the NTS-KE client response parser (nts_client_process_response_core) in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the client then sends in cleartext as NTS cookies, via an NTS-KE record whose declared length exceeds the data received.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS