NTPsec ntpd: Out-of-bounds read in NTS extension field parsing (CVE-2026-102486)
NTPsec ntpd versions 1.1.4 through 1.2.5 are vulnerable to a remote denial-of-service attack due to an out-of-bounds read flaw triggered by malformed NTS extension fields.
CVE search metadata
CVE search record: CVE-2026-102486. Severity: high. CVSS: 7.5. KEV: no. Product: ntpd (1.1.4 through 1.2.5). Brief: NTPsec ntpd: Out-of-bounds read in NTS extension field parsing (CVE-2026-102486). Brief link: https://feed.craftedsignal.io/briefs/2026-10-ntpsec-dos/
Triage facts
Revision 1- Applicability
- ntpd (1.1.4 through 1.2.5)
- Evidence
- Unknown
- Severity
- Low
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 21, 17:10 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
NTPsec ntpd versions 1.1.4 through 1.2.5 contain a vulnerability in the parsing of Network Time Security (NTS) extension fields. An unauthenticated remote attacker can send a crafted NTS Authenticator and Encrypted Extension Fields (AEEF) field containing an oversized nonce length. This triggers an out-of-bounds read, causing the ntpd daemon to crash. There is currently no mention of remote code execution or authentication bypass.
Impact
Successful exploitation results in a denial-of-service (DoS) condition, as the ntpd daemon crashes when processing the malformed AEEF packet.
Recommendation
- Inventory all systems running NTPsec ntpd 1.1.4 through 1.2.5.
- Monitor for anomalous ntpd crash events or sudden service restarts on internet-facing time synchronization servers.
- Patch to the latest stable release of NTPsec ntpd once the vendor provides a resolution.
Immediate actions
Identify all servers running affected versions of NTPsec ntpd.
Mitigations
Upgrade to the latest non-vulnerable version of NTPsec ntpd as soon as available.
CVE-2026-102486