CVE-2026-121506
HighCVSS 7.4Summary
An out-of-bounds read and write in NTS client extension field parsing (extens_client_recv) in NTPsec before 1.2.5 allows a remote attacker who can send NTP server-mode replies to an NTS client to corrupt heap memory and crash ntpd, and, combined with the NTS-KE client out-of-bounds read fixed in 1.2.4, to bypass NTS authentication and set the client's time.
Risk Assessment
Remote memory corruption and ntpd crashes are possible, and NTS authentication can be bypassed, allowing an attacker to manipulate system time.
Recommendation
Update NTPsec to version 1.2.5 or later.
Other vulnerabilities in NTPsec
See all- CVE-2026-121505Low
An out-of-bounds read in the NTS-KE client response parser (nts_client_process_response_core) in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the client then sends in cleartext as NTS cookies, via an NTS-KE record whose declared length exceeds the data received.
- CVE-2026-102484Medium
Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the Telephone JJY time source to corrupt memory or crash ntpd via more than six time replies.
- CVE-2026-18321Medium
In NTPsec, a buffer overflow in the Zyfer reference clock driver allows a local attacker to crash the ntpd process.
Original NVD description (English source)
An out-of-bounds read and write in NTS client extension field parsing (extens_client_recv) in NTPsec before 1.2.5 allows a remote attacker who can send NTP server-mode replies to an NTS client to corrupt heap memory and crash ntpd, and, combined with the NTS-KE client out-of-bounds read fixed in 1.2.4, to bypass NTS authentication and set the client's time, via an NTS Authenticator and Encrypted Extension Fields field whose nonce length exceeds the field.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS