CVE-2026-121505: Out-of-bounds Read in NTPsec

Published Nov 3, 2026

Updated

An out-of-bounds read in the NTS-KE client response parser (ntsclientprocessresponsecore) in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the client then sends in cleartext as NTS cookies, via an NTS-KE record whose declared length exceeds the data received.

Event History

Nov 3, 2026

CVE Published

via MITRE·02:17 PM

Data Sourced

via MITRE·02:17 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via OSV·02:17 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

NTPsec clients running versions before 1.2.4 are exposed when they process responses from a malicious NTS-KE server.

What must an attacker control to exploit this?

The attacker needs to operate or control the NTS-KE server that the client contacts and send an NTS-KE record whose declared length is greater than the data actually received. No client-side privileges or user interaction are indicated.

What is the remediation?

Upgrade NTPsec to version 1.2.4 or later. The provided information does not describe a workaround for systems that cannot yet be upgraded.

CVE-2026-121505: Out-of-bounds Read in NTPsec

Event History

Frequently Asked Questions

Which deployments are exposed?

What must an attacker control to exploit this?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What must an attacker control to exploit this?

What is the remediation?