Medium severity · published Oct 21, 2026
CVE-2026-102484
Heap-based Buffer Overflow in ntpsec
New
6.4
CVSS
0.2%
EPSS
No
On KEV
Description
Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the Telephone JJY time source to corrupt memory or crash ntpd via more than six time replies.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NT
ntpsec · NTPsec
before 1.2.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-102484
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-102484
gitlab.com
https://gitlab.com/NTPsec/ntpsec/-/commit/62a454f6fcb6f2dcc8d5866f6558905ebdb7dd69
gitlab.com
https://gitlab.com/NTPsec/ntpsec/-/work_items/895
More from ntpsec
9.1
CVE-2019-6443
An issue was discovered in NTPsec before 1.1.3
9.1
CVE-2019-6444
An issue was discovered in NTPsec before 1.1.3
7.5
CVE-2026-102486
Out-of-bounds Read in ntpsec
7.5
CVE-2026-102483
Reachable Assertion in ntpsec
7.5
CVE-2023-4012
ntpd will crash if the server is not NTS-enabled (no certificate) and it receives an NTS-enabled client request (mode 3)