Read the docs
TI-2026-78848 Aliases CVE-2026-102484GHSA-pmw6-wmf7-r2cg

Heap-based buffer overflow in NTPsec JJY refclock driver

Priority LOW 28CWE-122Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

NTPsec ntpd before 1.2.6 is affected. A heap-based buffer overflow (CWE-122) in the JJY refclock driver lets an attacker who controls the Telephone JJY time source corrupt memory or crash ntpd by sending more than six time replies. The attacker needs no privileges and no user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the Telephone JJY time source to corrupt memory or crash ntpd via more than six time replies.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00205 10th percentileScored 2026-11-07
Fix Fixed ntpsec (NTPsec): 1.2.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NTPsecntpsecbefore 1.2.61.2.6Patch availableCNA
  • ntpsec VendorNTPsec Affected before 1.2.6 Fixed in 1.2.6 Patch available CNA

Remediation

Upgrade the ntpsec package to version 1.2.6, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA ntpsec (NTPsec) Fixed in 1.2.6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    ntpsec 1.2.6

    4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2026-78850 Out-of-bounds read in NTPsec ntpd NTS extension field parsingPriority MEDIUM 40
    • TI-2026-78847 Reachable assertion in NTPsec lets remote attackers terminate ntpdPriority LOW 39
    • TI-2026-78849 Out-of-bounds read in NTPsec ntpd Motorola Oncore driverPriority LOW 23
    Show all 4 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-102484
  2. 2026-10-21 Alias added: GHSA-pmw6-wmf7-r2cg
  3. 2026-10-23 Priority changed: MEDIUM → LOW
  4. 2026-10-29 CISA SSVC decision points changed
  5. 2026-11-06 Affected versions changed · Red Hat
  6. 2026-11-06 CVSS score added · Red Hat

References

Other 2

  • TI-2019-04513 An issue was discovered in NTPsec before 1.1.3. CVSS 3.0CRITICAL 9.1
  • TI-2019-04514 An issue was discovered in NTPsec before 1.1.3. CVSS 3.0CRITICAL 9.1
  • TI-2026-42067 gpsd gpsprof Command Injection via gnuplot plot title subtype field CVSS 4.0HIGH 8.4
  • TI-2019-04515 An issue was discovered in NTPsec before 1.1.3. CVSS 3.0MEDIUM 6.5
  • TI-2019-04512 An issue was discovered in NTPsec before 1.1.3. CVSS 3.0MEDIUM 6.5
  • TI-2026-78850 Out-of-bounds read in NTPsec ntpd NTS extension field parsing CVSS 3.1HIGH 7.5
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences