Live › vulnerability › CVE-2026-102485
Go to dashboardThe Motorola Oncore reference clock driver in NTPsec ntpd reads past a buffer when a PPS Control reply carries an out-of-range mode byte. An attacker who controls the GPS receiver's serial data can crash ntpd or read process memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems running NTPsec ntpd before 1.2.6 with a Motorola Oncore GPS receiver configured as a reference clock are exposed, because the flaw is in that serial driver path. The attacker must control or spoof the serial data from the receiver. Servers without an Oncore refclock can skip it.
No product ranges from the sources yet.
ntpd --version or ntpq -c version and compare against 1.2.6grep -i oncore /etc/ntp.conf or grep -i oncore /etc/ntpsec/ntp.conf1.2.6 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Out-of-bounds read in the Motorola Oncore refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the GPS receiver's serial data to crash ntpd or disclose memory via a PPS Control (@@Gc) reply with an out-of-range mode byte.
This page as .md · .json · in your agent: get_signal("CVE-2026-102485")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.