NTPsec: Heap memory corruption via NTS client extension field parsing (CVE-2026-121506)
NTPsec before 1.2.5 is vulnerable to an out-of-bounds read and write in NTS client extension field parsing, which can lead to heap memory corruption, service crashes, and authentication bypass.
CVE search metadata
CVE search record: CVE-2026-121506. Severity: high. CVSS: 7.4. KEV: no. Product: NTPsec (< 1.2.5). Brief: NTPsec: Heap memory corruption via NTS client extension field parsing (CVE-2026-121506). Brief link: https://feed.craftedsignal.io/briefs/2026-11-03-ntpsec-nts-cve/
Triage facts
Revision 1- Applicability
- NTPsec (< 1.2.5)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 3, 16:01 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
An out-of-bounds read and write in NTS client extension field parsing (extens_client_recv) in NTPsec before 1.2.5 allows a remote attacker who can send NTP server-mode replies to an NTS client to corrupt heap memory and crash ntpd. When combined with an NTS-KE client out-of-bounds read vulnerability (fixed in 1.2.4), an attacker can bypass NTS authentication and set the client's time via an NTS Authenticator and Encrypted Extension Fields field whose nonce length exceeds the field.