NTPsec EUVD-2026-115827

The victim must be running NTPsec before 1.2.5 configured as an NTS client, and the attacker must be able to send NTP server-mode replies to that client (on-path position or successful spoofing). The trigger is a specific malformed input: an NTS Authenticator and Encrypted Extension Fields field whose declared nonce length exceeds the field, which the parser extens_client_recv mishandles. For the crash/heap-corruption path, exposure requires only a pre-1.2.5 NTS client. The full NTS authentication bypass and time-setting outcome additionally requires the client to be exposed to the NTS-KE client out-of-bounds read fixed in 1.2.4 (i.e., chaining against an unpatched or partially patched client). Limiting factors: NTS client mode must be in use (not a default for all ntpd deployments), the attacker needs a path to deliver server-mode replies, and CVSS rates attack complexity as high.

Signals point to a moderate, time-bound priority rather than an emergency. The input CVSS is 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H), and the vuln.today Decision label is 'this_week', consistent with a remotely reachable memory-corruption flaw that is non-trivial to trigger (AC:H). No EPSS score is provided, the CVE is not in CISA KEV, and no SSVC automatable/technical-impact decision is supplied, so there is no evidence of active or automated exploitation. The two references are a GitLab patch commit and a work item - not verified exploit code - so this is 'no public exploit identified at time of analysis.' The impact profile is notable: beyond a heap corruption and ntpd crash (A:H), when chained with the separate NTS-KE client out-of-bounds read fixed in 1.2.4, an attacker can bypass NTS authentication and set the client's clock (I:H), which undermines the exact security guarantee NTS exists to provide. The AC:H and the requirement to deliver NTP server-mode replies to a victim NTS client temper the raw severity; the auth-bypass/time-setting outcome requires an unpatched (pre-1.2.4) peer, so a client already on 1.2.4 but below 1.2.5 faces the crash/corruption path, not necessarily the full bypass. No key signals are directly conflicting, but EPSS and SSVC data are simply absent, which limits confidence in real-world exploitation likelihood.

An on-path or spoofing attacker who can deliver NTP server-mode replies to a victim NTPsec NTS client sends a reply containing an NTS Authenticator and Encrypted Extension Fields field whose declared nonce length exceeds the field, driving an out-of-bounds read and write in extens_client_recv that corrupts heap memory and crashes ntpd. Against a client still exposed to the pre-1.2.4 NTS-KE out-of-bounds read, the same primitive can be chained to bypass NTS authentication and set the client's time. No verified public exploit code exists; only the upstream patch commit and work item are referenced.