What is the CVSS score of CVE-2026-18321?

CVE-2026-18321 has a CVSS 3.1 base score of 4.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-18321?

Yes, a patch is available for CVE-2026-18321. Update the affected software to the latest version immediately.

NTPsec CVE-2026-18321

EUVD-2026-51593 MEDIUM

Classic Buffer Overflow (CWE-120)

2026-07-31 GitLab

GHSA-6978-pcpc-2c45

Buffer Overflow Ntpsec

4.7

CVSS 3.1 · Vendor: GitLab

Severity by source

Vendor (GitLab) PRIMARY

4.7 MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.7 MEDIUM

Local-only vector, low privilege, and high complexity match Zyfer driver access constraints; no C/I impact, A:H from ntpd crash.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.7 LOW

qualitative

Primary rating from Vendor (GitLab).

CVSS VectorVendor: GitLab

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 19:33 vuln.today

Patch available

Jul 31, 2026 - 19:02 EUVD

DescriptionCVE.org

Buffer overflow in NTPsec's Zyfer refclock allows local attacker to crash ntpd

AnalysisAI

Buffer overflow in NTPsec's Zyfer refclock driver crashes the ntpd daemon on affected systems running versions prior to 1.2.5. A local, low-privileged attacker with high attack complexity can trigger the CWE-120 classic buffer overflow, resulting in a denial-of-service impact limited to availability - no confidentiality or integrity exposure exists. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

NTPsec is a security-hardened fork of the NTP reference implementation designed for auditability and reduced attack surface. The Zyfer refclock is a driver for Zyfer brand hardware reference clocks - precision timing sources used in environments requiring GPS-disciplined or rubidium-standard timekeeping. CWE-120 (Classic Buffer Copy without Checking Size of Input) occurs when data is written into a fixed-size buffer without bounds validation, allowing adjacent memory to be overwritten. In this case the overflow lies within the Zyfer refclock driver code path of ntpd, reachable only when that hardware clock is physically present and configured. The affected CPE is cpe:2.3:a:ntpsec:ntpsec:*:*:*:*:*:*:*:*, covering all NTPsec releases from version 0 up to but not including 1.2.5 per EUVD-2026-51593.

RemediationAI

Upgrade NTPsec to version 1.2.5 or later, which contains the vendor-provided fix for this buffer overflow as tracked at https://gitlab.com/NTPsec/ntpsec/-/work_items/890. Patch availability is confirmed per vendor and EUVD-2026-51593, though an explicit patch advisory URL beyond the GitLab work item was not present in the provided data. If an immediate upgrade is not feasible, disable the Zyfer refclock driver in the ntpd configuration file by removing or commenting out the relevant 'refclock' directive referencing the Zyfer unit - this eliminates the vulnerable code path entirely at the cost of losing Zyfer hardware clock input; another time source should be substituted. Additionally, restricting local shell access to trusted users reduces the PR:L attack surface while the patch is being applied.