CVE-2026-102486

Full vulnerability record from the local CVENow database.

Description

Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS Authenticator and Encrypted Extension Fields (AEEF) field with an oversized nonce length.

Severity

HIGH

CVSS score

7.5 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-10-21 16:17:14.313000

Last modified

2026-10-29 21:17:08.210000

View original CVE JSON

{
  "id": "CVE-2026-102486",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-21T16:17:14.313",
  "lastModified": "2026-10-29T21:17:08.210",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS Authenticator and Encrypted Extension Fields (AEEF) field with an oversized nonce length."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "NTPsec",
          "product": "ntpsec",
          "defaultStatus": "unaffected",
          "repo": "https://gitlab.com/NTPsec/ntpsec",
          "versions": [
            {
              "version": "1.1.4",
              "lessThan": "1.2.6",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-29T18:34:57.116352Z",
          "id": "CVE-2026-102486",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://gitlab.com/NTPsec/ntpsec/-/commit/7cc079387",
      "source": "[email protected]"
    },
    {
      "url": "https://gitlab.com/NTPsec/ntpsec/-/work_items/891",
      "source": "[email protected]"
    },
    {
      "url": "https://gitlab.com/NTPsec/ntpsec/-/work_items/895",
      "source": "[email protected]"
    }
  ]
}