Live › vulnerability › CVE-2026-102484
Go to dashboardNTPsec's ntpd has a heap buffer overflow in its JJY reference clock driver, triggered when more than six time replies arrive from a Telephone JJY time source. An attacker controlling that time source can corrupt memory or crash ntpd.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only hosts running NTPsec ntpd before 1.2.6 with the JJY refclock driver configured are exposed. The attacker must control the Telephone JJY time source that the host reads from, so hosts that sync only to pools or other normal NTP servers are unlikely to be at risk.
No product ranges from the sources yet.
ntpd --version (or ntpq -c version) to read the NTPsec versionserver 127.127.40.x JJY refclock line (driver 40)1.2.6 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the Telephone JJY time source to corrupt memory or crash ntpd via more than six time replies.
This page as .md · .json · in your agent: get_signal("CVE-2026-102484")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.