NTPsec EUVD-2026-51593

Exploitation requires all of the following: (1) a Zyfer hardware reference clock must be physically connected to the target system and the Zyfer refclock driver must be explicitly enabled in ntpd's configuration - systems without this hardware or with the driver disabled are unaffected regardless of NTPsec version; (2) the attacker must hold a local, low-privileged system account (CVSS PR:L), ruling out remote or unauthenticated exploitation; (3) high attack complexity (CVSS AC:H) means the attacker must satisfy specific preconditions - likely precise input crafting or race conditions - making reliable exploitation non-trivial. Limiting factors are: local-only vector, requirement for Zyfer hardware presence, non-default refclock configuration, and AC:H trigger difficulty.

The CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H yields a Medium score of 4.7, which accurately reflects the constrained exploitation scenario. The local attack vector (AV:L) eliminates remote exploitation entirely, and the high attack complexity (AC:H) indicates the attacker cannot reliably trigger the overflow without meeting specific additional conditions - likely precise input timing or format constraints. Low privileges (PR:L) require the attacker to already hold a local system account. No EPSS data was provided, no KEV listing is present, and no public exploit has been identified - all signals point to a low-urgency issue. The impact is exclusively availability: a crash of ntpd, which on systems serving as time sources for downstream infrastructure (authentication servers, financial ledgers, logging pipelines) could have cascading effects. This vulnerability is a real but low-priority remediation target; only environments using Zyfer hardware refclocks with untrusted local users face meaningful exposure.

A local attacker with a low-privileged shell account on a system running NTPsec with a Zyfer hardware refclock configured manipulates input handled by the Zyfer driver - under specific timing or format conditions meeting the AC:H bar - to trigger the CWE-120 buffer overflow in ntpd, causing the daemon to crash. On infrastructure where ntpd serves as a stratum source for downstream systems such as authentication services or financial transaction logs, this crash degrades time accuracy until the service is manually restarted. No public exploit code has been identified at time of analysis.