Live › vulnerability › CVE-2026-102486
Go to dashboardNTPsec ntpd versions 1.1.4 through 1.2.5 read past the end of a buffer when parsing NTS Authenticator and Encrypted Extension Fields. A remote attacker can send a packet with an oversized nonce length to crash the daemon.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Hosts running NTPsec ntpd between versions 1.1.4 and 1.2.5 that accept NTP traffic from networks an attacker can reach. The sources do not say whether NTS must be enabled, so systems on those versions should be treated as exposed. Hosts running other NTP implementations or NTPsec outside that range are not affected.
No product ranges from the sources yet.
ntpd --version or ntpq -c version on each host running NTPsec and compare against the affected range 1.1.4 through 1.2.5.nts directives in ntp.conf); the sources do not say whether the flaw requires NTS to be configured.1.2.5; the sources do not name the fixed version.123) where possible.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS Authenticator and Encrypted Extension Fields (AEEF) field with an oversized nonce length.
This page as .md · .json · in your agent: get_signal("CVE-2026-102486")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.