Live › vulnerability › CVE-2026-121505
A bug in NTPsec's NTS-KE client response parser lets a malicious NTS-KE server make the client read past its buffer. The client then sends that stack memory, including pointers that weaken ASLR, back in cleartext as NTS cookies.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:22 UTC. All times on this page are UTC.
Only systems running the NTPsec time daemon as an NTS client that connect to a malicious or compromised NTS-KE server are exposed. Servers that do not use NTS key establishment, or that only talk to trusted NTS servers, are at much lower risk.
No product ranges from the sources yet.
ntpq --version or ntpd --versionnts keyword in ntp.conf or ntpsec config)1.2.4 or later (the advisory states fixes start at before 1.2.4)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An out-of-bounds read in the NTS-KE client response parser (nts_client_process_response_core) in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the client then sends in cleartext as NTS cookies, via an NTS-KE record whose declared length exceeds the data received.
This page as .md · .json · in your agent: get_signal("CVE-2026-121505")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.