CVE-2026-121505

LOW 3.7

Out-of-bounds Read in NTPsec

CVSS Score

3.7

EPSS Score

0.0%

EPSS Percentile

0th

An out-of-bounds read in the NTS-KE client response parser (nts_client_process_response_core) in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the client then sends in cleartext as NTS cookies, via an NTS-KE record whose declared length exceeds the data received.

CWE	CWE-125
Vendor	ntpsec
Product	ntpsec
Published	Nov 3, 2026

Stay Ahead of the Next One

Get instant alerts for ntpsec ntpsec

Be the first to know when new low vulnerabilities affecting ntpsec ntpsec are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

NTPsec / NTPsec

1.1.4 < 1.2.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

gitlab.com: https://gitlab.com/NTPsec/ntpsec/-/commit/caf0eb5df3c6ddbfc2941389bff0f9146835c021 gitlab.com: https://gitlab.com/NTPsec/ntpsec/-/work_items/836 gitlab.com: https://gitlab.com/NTPsec/ntpsec/-/work_items/902

Credits

Artem Nasonov (Astra Linux) found and fixed the issue; Erica Windisch (Cyberdione Labs) analyzed its impact