Live › vulnerability › CVE-2026-121506
NTPsec's NTS client parses extension fields without checking bounds, so a crafted server-mode NTP reply can corrupt heap memory and crash ntpd. Combined with a separate NTS-KE out-of-bounds read fixed in 1.2.4, an attacker can bypass NTS authentication and set the client's clock.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:22 UTC. All times on this page are UTC.
Systems running NTPsec ntpd as an NTS client that accept NTP server-mode replies. Hosts that only use plain NTP without NTS, or that run other NTP implementations, are not covered by these sources.
No product ranges from the sources yet.
ntpd --version or ntpq -c version on each host and compare against the fixed release.nts directives in ntp.conf).1.2.5 or later (the sources say fixed before 1.2.5; the 1.2.4 NTS-KE fix is also needed).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An out-of-bounds read and write in NTS client extension field parsing (extens_client_recv) in NTPsec before 1.2.5 allows a remote attacker who can send NTP server-mode replies to an NTS client to corrupt heap memory and crash ntpd, and, combined with the NTS-KE client out-of-bounds read fixed in 1.2.4, to bypass NTS authentication and set the client's time, via an NTS Authenticator and Encrypted Extension Fields field whose nonce length exceeds the field.
This page as .md · .json · in your agent: get_signal("CVE-2026-121506")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.