{"id":"CVE-2026-102485","kind":"vulnerability","aliases":["CVE-2026-102485"],"related":[],"title":"NTPsec: out-of-bounds read in Oncore GPS driver crashes ntpd or leaks memory","description":"Out-of-bounds read in the Motorola Oncore refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the GPS receiver's serial data to crash ntpd or disclose memory via a PPS Control (@@Gc) reply with an out-of-range mode byte.","summary":"The Motorola Oncore reference clock driver in NTPsec ntpd reads past a buffer when a PPS Control reply carries an out-of-range mode byte. An attacker who controls the GPS receiver's serial data can crash ntpd or read process memory.","severity":"medium","cvss":5.2,"epss":0.00238,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ntp","ntpsec","package","self-hosted","time-servers"],"not_affected_if":["no-oncore-refclock","ntpd-1.2.6-or-later"],"how_to_check":"- Run `ntpd --version` or `ntpq -c version` and compare against `1.2.6`\n- Check whether the Oncore refclock driver is configured, e.g. `grep -i oncore /etc/ntp.conf` or `grep -i oncore /etc/ntpsec/ntp.conf`","fix":"- Upgrade NTPsec to `1.2.6` or later\n- Until patched, remove or disable Oncore refclock lines in the ntp configuration","status":"open","published_at":"2026-10-21T16:17:14+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:28:47+00:00","updated_at":"2026-10-25T04:28:47+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:28:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade NTPsec to `1.2.6` or later\n- Until patched, remove or disable Oncore refclock lines in the ntp configuration","reach":"local","title":"NTPsec: out-of-bounds read in Oncore GPS driver crashes ntpd or leaks memory","impact":"medium","summary":"The Motorola Oncore reference clock driver in NTPsec ntpd reads past a buffer when a PPS Control reply carries an out-of-range mode byte. An attacker who controls the GPS receiver's serial data can crash ntpd or read process memory.","category":"package","nicknames":[],"who_cares":["ntpsec","ntp","time-servers","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"ntpd crashes or leaks process memory to a serial-data attacker","analyst_note":"","how_to_check":"- Run `ntpd --version` or `ntpq -c version` and compare against `1.2.6`\n- Check whether the Oncore refclock driver is configured, e.g. `grep -i oncore /etc/ntp.conf` or `grep -i oncore /etc/ntpsec/ntp.conf`","needs_analyst":false,"not_affected_if":["no-oncore-refclock","ntpd-1.2.6-or-later"],"who_is_affected":"Only systems running NTPsec ntpd before 1.2.6 with a Motorola Oncore GPS receiver configured as a reference clock are exposed, because the flaw is in that serial driver path. The attacker must control or spoof the serial data from the receiver. Servers without an Oncore refclock can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000638,"input_tokens":3373,"output_tokens":602,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-102485':18A,21A '-2026':17A,20A '1.2.6':89C 'allow':90C 'attack':58B,92C 'bound':5A,77C 'buffer':43B 'byte':56B,120C 'carri':49B 'clock':35B 'control':47B,60B,94C,110C 'crash':11A,68B,102C 'cve':16A,19A 'data':66B,100C 'disclos':105C 'driver':10A,36B,84C 'gc':111C 'gps':9A,62B,96C 'host':27B 'leak':14A 'memori':15A,73B,106C 'mode':55B,119C 'motorola':32B,81C 'ntp':22B 'ntpd':12A,39B,69B,87C,103C 'ntpsec':1A,23B,38B,86C 'oncor':8A,33B,82C 'out-of-bound':2A,74C 'out-of-rang':51B,115C 'packag':24B 'past':41B 'pps':46B,109C 'process':72B 'rang':54B,118C 'read':6A,40B,71B,78C 'receiv':63B,97C 'refclock':83C 'refer':34B 'repli':48B,112C 'self':26B 'self-host':25B 'serial':65B,99C 'server':30B 'time':29B 'time-serv':28B 'via':107C","nicknames":[],"mitigations":[],"who_affected":"Only systems running NTPsec ntpd before 1.2.6 with a Motorola Oncore GPS receiver configured as a reference clock are exposed, because the flaw is in that serial driver path. The attacker must control or spoof the serial data from the receiver. Servers without an Oncore refclock can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T16:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102485","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102485","severity":null,"published_at":"2026-10-21T16:17:14+00:00","modified_at":"2026-10-22T16:18:19+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-102485","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102485","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}