---
id: "CVE-2026-102484"
kind: "vulnerability"
aliases: ["CVE-2026-102484"]
title: "NTPsec: JJY refclock overflow lets a time source crash or corrupt ntpd"
severity: "medium"
cvss: 6.4
epss: 0.00264
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ntpsec", "package", "self-hosted", "time-sync"]
not_affected_if: ["default-config", "no-jjy-refclock", "ntp-pool-only"]
published_at: "2026-10-21T16:17:14+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T03:59:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102484", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-102484", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# NTPsec: JJY refclock overflow lets a time source crash or corrupt ntpd

NTPsec's ntpd has a heap buffer overflow in its JJY reference clock driver, triggered when more than six time replies arrive from a Telephone JJY time source. An attacker controlling that time source can corrupt memory or crash ntpd.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `ntpd --version` (or `ntpq -c version`) to read the NTPsec version
- Check whether the config uses a `server 127.127.40.x` JJY refclock line (driver 40)

## Fix

- Upgrade NTPsec to `1.2.6` or later
- Until patched, remove the JJY refclock driver from the ntpd config if it is not needed

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-102484
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-102484

## From the sources

Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the Telephone JJY time source to corrupt memory or crash ntpd via more than six time replies.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_