CVE-2026-102486: Out-of-bounds Read in ntpsec

Q: Which deployments are exposed?

NTPsec ntpd versions 1.1.4 through 1.2.5 are affected when they parse NTS Authenticator and Encrypted Extension Fields (AEEF) data. The issue is reachable remotely.

Q: What does an attacker need to send?

An unauthenticated remote attacker needs to send an AEEF field containing an oversized nonce length. No user interaction or prior privileges are required.

Q: What is the likely impact of successful exploitation?

Successful exploitation can crash the ntpd daemon, causing a denial of service. The provided data does not indicate confidentiality or integrity impact.

Published Oct 21, 2026

Updated

Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS Authenticator and Encrypted Extension Fields (AEEF) field with an oversized nonce length.

Affected Software

1 affected component

NTPsec ntpd>=1.1.4<=1.2.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ntpsec to a version that resolves this vulnerability.
Fixed in 1.2.6

Event History

Oct 21, 2026

CVE Published

via MITRE·03:04 PM

Data Sourced

via MITRE·03:04 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

NTPsec ntpd versions 1.1.4 through 1.2.5 are affected when they parse NTS Authenticator and Encrypted Extension Fields (AEEF) data. The issue is reachable remotely.

What does an attacker need to send?

An unauthenticated remote attacker needs to send an AEEF field containing an oversized nonce length. No user interaction or prior privileges are required.

What is the likely impact of successful exploitation?

Successful exploitation can crash the ntpd daemon, causing a denial of service. The provided data does not indicate confidentiality or integrity impact.

CVE-2026-102486: Out-of-bounds Read in ntpsec

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to send?

What is the likely impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to send?

What is the likely impact of successful exploitation?