CVE-2026-121506

Full vulnerability record from the local CVENow database.

Description

An out-of-bounds read and write in NTS client extension field parsing (extens_client_recv) in NTPsec before 1.2.5 allows a remote attacker who can send NTP server-mode replies to an NTS client to corrupt heap memory and crash ntpd, and, combined with the NTS-KE client out-of-bounds read fixed in 1.2.4, to bypass NTS authentication and set the client's time, via an NTS Authenticator and Encrypted Extension Fields field whose nonce length exceeds the field.

Severity

HIGH

CVSS score

7.4 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-11-03 15:17:37.717000

Last modified

2026-11-03 16:17:24.840000

View original CVE JSON

{
  "id": "CVE-2026-121506",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-03T15:17:37.717",
  "lastModified": "2026-11-03T16:17:24.840",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An out-of-bounds read and write in NTS client extension field parsing (extens_client_recv) in NTPsec before 1.2.5 allows a remote attacker who can send NTP server-mode replies to an NTS client to corrupt heap memory and crash ntpd, and, combined with the NTS-KE client out-of-bounds read fixed in 1.2.4, to bypass NTS authentication and set the client's time, via an NTS Authenticator and Encrypted Extension Fields field whose nonce length exceeds the field."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "NTPsec",
          "product": "NTPsec",
          "defaultStatus": "unaffected",
          "repo": "https://gitlab.com/NTPsec/ntpsec",
          "versions": [
            {
              "version": "1.1.4",
              "lessThan": "1.2.5",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-11-03T15:15:17.727246Z",
          "id": "CVE-2026-121506",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://gitlab.com/NTPsec/ntpsec/-/commit/0a36941e499d533dfbc3fb6b1fcd8c367679d719",
      "source": "[email protected]"
    },
    {
      "url": "https://gitlab.com/NTPsec/ntpsec/-/work_items/902",
      "source": "[email protected]"
    }
  ]
}