What is the CVSS score of CVE-2026-102486?

CVE-2026-102486 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.8%.

How to fix or mitigate CVE-2026-102486?

Within 24 hours, inventory all NTPsec ntpd deployments, confirm which run versions 1.1.4 through 1.2.5, and identify any instances with Network Time Security configured and enabled; where NTS is not strictly required, disable it and restrict UDP 123 access to trusted time consumers. Within 7 days, add monitoring for ntpd process crashes and unexpected restarts on affected hosts, validate alternate time sources for critical systems, and apply vendor mitigations or configuration hardening guidance as it becomes available from the NTPsec project. Within 30 days, plan migration away from affected NTPsec ntpd 1.1.4 through 1.2.5 to a supported release once a fix is published, or implement a risk-accepted, segmented time-service architecture with compensating network controls and documented exception approval.

NTPsec ntpd CVE-2026-102486

Q: Which versions of NTPsec ntpd are affected by CVE-2026-102486?

A high-severity availability flaw in NTPsec ntpd 1.1.4 through 1.2.5 can allow a network-based attacker to crash time-service daemons that have Network Time Security enabled, disrupting time…. A patch is available.

EUVD-2026-107312 HIGH

Out-of-bounds Read (CWE-125)

2026-10-21 GitLab

GHSA-c93g-vwm4-hch3

Buffer Overflow Information Disclosure Ntpsec

7.5

CVSS 3.1 · Vendor: GitLab

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach NTS-enabled ntpd over network
Exploit

Craft NTS AEEF field with oversized nonce length
Execution

Trigger out-of-bounds read in extension-field parser
Impact

Crash daemon, deny time service

Vulnerability Assessment

Weakness	CWE CWE-125 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, read limits MITRE ATT&CK 1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Target must run NTPsec ntpd 1.1.4 through 1.2.5 with NTS (Network Time Security) enabled/configured, because the vulnerable code path is NTS Authenticator and Encrypted Extension Fields (AEEF) parsing - instances without NTS do not process the affected extension and are not exposed. When NTS is active, no authentication, no user interaction, and no non-default tuning are required: the attacker simply sends a crafted packet with an oversized nonce length over the network. The primary limiting factor is the NTS deployment requirement, which is not the default for many NTP installations and significantly reduces the exposed population.
Impact	This is a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remotely reachable, unauthenticated, low-complexity denial of service with no user interaction - a strong profile for easy triggering. However, impact is confined to availability only (C:N/I:N): this is an out-of-bounds READ (CWE-125) that crashes the daemon, not a code-execution or data-disclosure bug, so the 'Information Disclosure' tag conflicts with the authoritative C:N rating and should be treated with suspicion. Exploitation is gated by a configuration prerequisite not reflected in the CVSS score: the bug lives in NTS (Network Time Security) extension-field parsing, so only ntpd instances actually configured with NTS are exposed, which meaningfully narrows the real attack surface below what AV:N/PR:N alone implies. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or at-scale exploitation. Net: a real, patch-worthy DoS for NTS-enabled NTPsec operators, but not an emergency for the broader population that does not run NTS.
Exploit ScenarioDerived	A remote attacker who can reach an NTPsec ntpd instance (versions 1.1.4-1.2.5) that has NTS enabled sends a single crafted NTS Authenticator and Encrypted Extension Fields (AEEF) packet declaring an oversized nonce length. The malformed length drives the parser to read past the bounds of the buffer, crashing the daemon and denying time service. No authentication, user interaction, or public exploit code is required or known, though the low attack complexity makes reliable triggering straightforward.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.8% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 21, 2026

Remote denial of service in NTPsec ntpd 1.1.4 through 1.2.5 lets an unauthenticated network attacker crash the daemon by sending a crafted NTS Authenticator and Encrypted Extension Fields (AEEF) field with an oversized nonce length, but only on instances where Network Time Security is actually configured and enabled. The out-of-bounds read terminates the process, producing a pure availability impact with no confidentiality or integrity loss, and no public exploit code has been identified at time of analysis. The NTS deployment prerequisite - not the default for many NTP installations - substantially bounds the exposed population, making this a genuine but limited availability risk.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed. The corrective change is GitLab commit 7cc079387, tracked under work items 891 and 895 (https://gitlab.com/NTPsec/ntpsec/-/work_items/891, https://gitlab.com/NTPsec/ntpsec/-/work_items/895), so operators should monitor NTPsec releases, confirm which tagged version first contains that commit, and upgrade from the 1.1.4-1.2.5 range as soon as it is published rather than assuming any specific fixed version number. Where upgrading cannot be done immediately, the most direct mitigation is to disable NTS in the ntpd configuration if authenticated time is not operationally required - this removes the vulnerable AEEF parsing path entirely, at the cost of losing NTS authentication and reverting to unauthenticated NTP with its spoofing exposure. Alternatively, restrict UDP/TCP 123 and NTS-KE (TCP 4460) to known, trusted time peers and clients via firewall or ACL rules; this shrinks the attacker population but leaves the bug reachable from any permitted source and adds maintenance overhead as peer lists change. Run ntpd under service supervision (systemd Restart=on-failure or equivalent) so a successful crash is recovered automatically, and alert on unexpected daemon restarts as a detection signal.

Affected VersionsENISA

NTPSec 1.1.4 <1.2.6

Affected Packages

euvd ntpsec fix: 1.2.6

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

NTPsec is a hardened fork of the reference NTP daemon, and Network Time Security (NTS) is its authenticated time-transfer mechanism, comprising an NTS-KE key exchange plus packet-level Authenticator and Encrypted Extension Fields (AEEF) carried in NTP extension fields. The vulnerable code is the AEEF parser, which reads a nonce-length value from the packet and uses it to walk the extension data without adequately validating it against the remaining buffer; an oversized length drives the parser past the end of the received packet, an out-of-bounds read classified as CWE-125. Because the daemon dereferences and copies past the allocated buffer, the fault typically manifests as a crash or abort rather than any data exposure, matching the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector with high availability impact only. The CPE cpe:2.3:a:ntpsec:ntpsec:*:*:*:*:*:*:*:* is wildcarded, so the authoritative version range comes from the CVE description: 1.1.4 through 1.2.5. Exposure requires that the daemon be built with NTS support and that NTS be enabled in configuration; a plain NTP-only ntpd does not enter the AEEF parsing path and cannot be triggered by this packet.

Know when Ntpsec gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitLab) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI 7.5 HIGH

Remote unauthenticated crafted packet with no interaction gives AV:N/AC:L/PR:N/UI:N; out-of-bounds read only crashes the daemon, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitLab).

CVSS VectorVendor: GitLab

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Oct 21, 2026 - 17:18 EUVD

CVE Published

Oct 21, 2026 - 15:04 cve.org

HIGH 7.5

DescriptionCVE.org

Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS Authenticator and Encrypted Extension Fields (AEEF) field with an oversized nonce length.

Executive ViewAI

Why It Matters

A high-severity availability flaw in NTPsec ntpd 1.1.4 through 1.2.5 can allow a network-based attacker to crash time-service daemons that have Network Time Security enabled, disrupting time synchronization for dependent systems. The exposure is limited to organizations that have explicitly configured NTS, but for those affected the loss of a trusted time source can degrade authentication, logging, and operational workflows. No vendor-released patch is identified at time of analysis, and no public exploit has been identified at time of analysis, so leadership should prioritize asset discovery and interim exposure reduction.

Business Impact: Medium

Compensating Controls

No vendor-released patch identified at time of analysis; interim mitigations include disabling NTS on NTPsec ntpd 1.1.4 through 1.2.5 where not strictly required, restricting UDP 123 to trusted time clients and peers, monitoring for ntpd crashes or restarts, segmenting time services, and preparing migration to a fixed release once available.

Threat Intelligence Overview

EPSS Score

0.8%

Top 46% exploitable

Prevalence

Low

security-focused NTP fork, limited footprint vs reference ntpd/chrony

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.8%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.