CVE-2026-102485: Out-of-bounds Read in ntpsec

Q: Which deployments are exposed?

NTPsec ntpd deployments before version 1.2.6 are affected if they use the Motorola Oncore refclock driver and receive data from a GPS receiver over its serial interface.

Q: What access does an attacker need to exploit this issue?

An attacker must be able to control the GPS receiver's serial data. They can trigger the issue by sending a PPS Control (@@Gc) reply with an out-of-range mode byte.

Q: What is the immediate remediation?

Upgrade NTPsec ntpd to version 1.2.6 or later. Systems not using the Motorola Oncore refclock driver are not described as affected.

Published Oct 21, 2026

Updated

Out-of-bounds read in the Motorola Oncore refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the GPS receiver's serial data to crash ntpd or disclose memory via a PPS Control (@@Gc) reply with an out-of-range mode byte.

Affected Software

1 affected component

NTPsec NTPsec<1.2.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ntpsec to a version that resolves this vulnerability.
Fixed in 1.2.6

Event History

Oct 21, 2026

CVE Published

via MITRE·03:03 PM

Data Sourced

via MITRE·03:03 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

NTPsec ntpd deployments before version 1.2.6 are affected if they use the Motorola Oncore refclock driver and receive data from a GPS receiver over its serial interface.

What access does an attacker need to exploit this issue?

An attacker must be able to control the GPS receiver's serial data. They can trigger the issue by sending a PPS Control (@@Gc) reply with an out-of-range mode byte.

What is the immediate remediation?

Upgrade NTPsec ntpd to version 1.2.6 or later. Systems not using the Motorola Oncore refclock driver are not described as affected.

CVE-2026-102485: Out-of-bounds Read in ntpsec

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What access does an attacker need to exploit this issue?

What is the immediate remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What access does an attacker need to exploit this issue?

What is the immediate remediation?