Read the docs

NTPsec

Records15All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high6CVSS 7.0–8.9

Exploited now

NTPsec records in CISA KEV

No NTPsec vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Ntpsec 7 records HIGH

Records

15 records

TI-2026-42067 CVE-2026-58459 · GHSA-2hhc-4hqc-4mg8

gpsd gpsprof Command Injection via gnuplot plot title subtype field

Priority MEDIUM 44

gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding…

CVSS 4.0HIGH 8.4 Local No auth User interaction EPSS 0.02862 Published 2026-07-09 Fixed CWE-78
TI-2026-78850 CVE-2026-102486 · GHSA-c93g-vwm4-hch3

Out-of-bounds read in NTPsec ntpd NTS extension field parsing

Priority MEDIUM 40

Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS Authenticator and Encrypted Extension Fields (AEEF) field with an oversized non…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00548 Published 2026-10-21 Fixed in 1.2.6 CWE-125
TI-2026-78847 CVE-2026-102483 · GHSA-6xg3-q93h-wcgv

Reachable assertion in NTPsec lets remote attackers terminate ntpd

Priority LOW 39

Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request with excess NTS Cookie Placeholder extension fields.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00428 Published 2026-10-21 Fixed in 1.2.6 CWE-617
TI-2023-03725 CVE-2023-4012 · GHSA-777h-w3h9-x4qv

Incomplete Internal State Distinction in ntpsec

Priority LOW 39

ntpd will crash if the server is not NTS-enabled (no certificate) and it receives an NTS-enabled client request (mode 3).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0045 Published 2023-08-07 No fix listed CWE-372
TI-2026-84261 CVE-2026-121506 · GHSA-28fm-m2x6-h5pf

Out-of-bounds write in NTPsec NTS extension field parsing

Priority LOW 33

An out-of-bounds read and write in NTS client extension field parsing (extens_client_recv) in NTPsec before 1.2.5 allows a remote attacker who can send NTP server-mode replies to an NTS client to corrupt heap memory and…

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00449 Published 2026-11-03 Fixed in 1.2.5 CWE-787
TI-2026-78848 CVE-2026-102484 · GHSA-pmw6-wmf7-r2cg

Heap-based buffer overflow in NTPsec JJY refclock driver

Priority LOW 28

Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the Telephone JJY time source to corrupt memory or crash ntpd via more than six time replies.

CVSS 3.1MEDIUM 6.4 Physical No auth No interaction EPSS 0.00205 Published 2026-10-21 Fixed in 1.2.6 CWE-122
TI-2026-78849 CVE-2026-102485 · GHSA-wwwp-7879-75pf

Out-of-bounds read in NTPsec ntpd Motorola Oncore driver

Priority LOW 23

Out-of-bounds read in the Motorola Oncore refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the GPS receiver's serial data to crash ntpd or disclose memory via a PPS Control (@@Gc) reply with an…

CVSS 3.1MEDIUM 5.2 Physical No auth No interaction EPSS 0.00181 Published 2026-10-21 Fixed in 1.2.6 CWE-125
TI-2026-84260 CVE-2026-121505 · GHSA-rjr3-53fv-wjrf

Out-of-bounds read in NTPsec leaks client stack memory

Priority LOW 17

An out-of-bounds read in the NTS-KE client response parser (nts_client_process_response_core) in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00293 Published 2026-11-03 Fixed in 1.2.4 CWE-125
Open these records in search →