NTPsec ntpd CVE-2026-102485

Requires the ntpd instance to be built and configured with the Motorola Oncore refclock driver and connected to an Oncore-family GPS receiver - a stratum-1 time-server deployment, not a default configuration. The attacker must control the receiver's serial data path (physical access to the serial line, a malicious or tampered GPS unit, or a man-in-the-middle on that link) and send a PPS Control (@@Gc) reply carrying an out-of-range mode byte. Exploitation is LIMITED by the AV:P physical vector, the need for this specific hardware/driver combination, and the lack of any network-reachable path; no authentication is needed once serial data is controlled (PR:N), but the physical/serial prerequisite is the dominant limiting factor.

This is a genuinely low-to-moderate priority issue despite the A:H availability impact. The provided CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, base 5.2) hinges on AV:P (Physical) and the description's precondition that the attacker 'controls the GPS receiver's serial data' - meaning the attacker must sit on the serial link between the Motorola Oncore GPS receiver and the ntpd host, or compromise/spoof the receiver itself. This is not a remote network-facing flaw. No EPSS score, KEV listing, or public POC was supplied, so there is no signal of active or probable exploitation; per the input this is 'no public exploit identified at time of analysis.' The strongest signals (A:H crash, C:L memory disclosure) are real but gated behind a demanding access requirement that confines exploitation to physically adjacent or supply-chain-level attackers against a narrow hardware configuration. Signals are internally consistent - there is no network-vs-local conflict here; the only caveat is the 'Buffer Overflow' tag, which is imprecise for an out-of-bounds READ (CWE-125). Overall: a legitimate defect worth patching on exposed stratum-1 time servers, but not an urgent fleet-wide emergency.

An attacker with control over the serial data stream from a Motorola Oncore GPS receiver (via physical tap, a malicious/spoofed receiver, or a compromised intermediary) sends a crafted PPS Control (@@Gc) reply containing an out-of-range mode byte. The ntpd Oncore refclock driver reads past the bounds of its buffer, crashing the daemon (denial of service / loss of time sync) or leaking adjacent process memory. No public exploit code is identified at time of analysis, and the physical attack vector plus specific hardware requirement sharply limit realistic exploitation.