Read the docs
TI-2026-84260 Aliases CVE-2026-121505GHSA-rjr3-53fv-wjrf

Out-of-bounds read in NTPsec leaks client stack memory

Priority LOW 17CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

NTPsec from 1.1.4 before 1.2.4 is affected. An out-of-bounds read (CWE-125) in the NTS-KE client response parser lets a malicious NTS-KE server read the client's stack memory, including pointers that defeat ASLR. The client then sends that memory in cleartext as NTS cookies, triggered by an NTS-KE record whose declared length exceeds the data received. The attacker needs only to act as a malicious NTS-KE server, with high attack complexity.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

An out-of-bounds read in the NTS-KE client response parser (nts_client_process_response_core) in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the client then sends in cleartext as NTS cookies, via an NTS-KE record whose declared length exceeds the data received.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00293 22nd percentileScored 2026-11-07
Fix Fixed NTPsec (NTPsec): 1.2.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NTPsecNTPsec1.1.4 to before 1.2.41.2.4Patch availableCNA
  • NTPsec VendorNTPsec Affected 1.1.4 to before 1.2.4 Fixed in 1.2.4 Patch available CNA

Remediation

Upgrade NTPsec to version 1.2.4, which fixes this flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA NTPsec (NTPsec) Fixed in 1.2.4

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-121505
  2. 2026-11-03 Alias added: GHSA-rjr3-53fv-wjrf
  3. 2026-11-03 CISA SSVC decision points changed
  4. 2026-11-03 Affected versions changed · Red Hat
  5. 2026-11-03 CVSS score added · Red Hat

References

Other 3

  • TI-2019-04513 An issue was discovered in NTPsec before 1.1.3. CVSS 3.0CRITICAL 9.1
  • TI-2019-04514 An issue was discovered in NTPsec before 1.1.3. CVSS 3.0CRITICAL 9.1
  • TI-2026-42067 gpsd gpsprof Command Injection via gnuplot plot title subtype field CVSS 4.0HIGH 8.4
  • TI-2019-04515 An issue was discovered in NTPsec before 1.1.3. CVSS 3.0MEDIUM 6.5
  • TI-2019-04512 An issue was discovered in NTPsec before 1.1.3. CVSS 3.0MEDIUM 6.5
  • TI-2026-78850 Out-of-bounds read in NTPsec ntpd NTS extension field parsing CVSS 3.1HIGH 7.5
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences