Read the docs
TI-2026-78850 Aliases CVE-2026-102486GHSA-c93g-vwm4-hch3

Out-of-bounds read in NTPsec ntpd NTS extension field parsing

Priority MEDIUM 40CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

NTPsec ntpsec from 1.1.4 before 1.2.6 is affected. An out-of-bounds read in NTS extension field parsing (CWE-125) lets a remote attacker crash the ntpd daemon. The attacker sends an Authenticator and Encrypted Extension Fields (AEEF) field with an oversized nonce length, and needs no privileges or user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS Authenticator and Encrypted Extension Fields (AEEF) field with an oversized nonce length.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00548 46th percentileScored 2026-11-07
Fix Fixed ntpsec (NTPsec): 1.2.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NTPsecntpsec1.1.4 to before 1.2.61.2.6Patch availableCNA
  • ntpsec VendorNTPsec Affected 1.1.4 to before 1.2.6 Fixed in 1.2.6 Patch available CNA

Remediation

Upgrade ntpsec to version 1.2.6 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA ntpsec (NTPsec) Fixed in 1.2.6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    ntpsec 1.2.6

    4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2026-78847 Reachable assertion in NTPsec lets remote attackers terminate ntpdPriority LOW 39
    • TI-2026-78848 Heap-based buffer overflow in NTPsec JJY refclock driverPriority LOW 28
    • TI-2026-78849 Out-of-bounds read in NTPsec ntpd Motorola Oncore driverPriority LOW 23
    Show all 4 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-102486
  2. 2026-10-21 Alias added: GHSA-c93g-vwm4-hch3
  3. 2026-10-23 Priority changed: MEDIUM → LOW
  4. 2026-10-25 EPSS moved to the below the 50th percentile
  5. 2026-10-29 Affected versions changed · Red Hat
  6. 2026-10-29 CVSS score added · Red Hat
  7. 2026-10-29 CISA SSVC decision points changed
  8. 2026-10-29 Priority changed: LOW → MEDIUM

References

Other 3

  • TI-2019-04513 An issue was discovered in NTPsec before 1.1.3. CVSS 3.0CRITICAL 9.1
  • TI-2019-04514 An issue was discovered in NTPsec before 1.1.3. CVSS 3.0CRITICAL 9.1
  • TI-2026-42067 gpsd gpsprof Command Injection via gnuplot plot title subtype field CVSS 4.0HIGH 8.4
  • TI-2019-04515 An issue was discovered in NTPsec before 1.1.3. CVSS 3.0MEDIUM 6.5
  • TI-2019-04512 An issue was discovered in NTPsec before 1.1.3. CVSS 3.0MEDIUM 6.5
  • TI-2026-78847 Reachable assertion in NTPsec lets remote attackers terminate ntpd CVSS 3.1HIGH 7.5
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences