CVE-2026-102484

EUVD-2026-107310
Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the Telephone JJY time source to corrupt memory or crash ntpd via more than six time replies.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
GitLabCNA
6.4 MEDIUM
PHYSICAL
LOW
NONE
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
ntpsecntpsec
𝑥
< 1.2.6
CNA
Common Weakness Enumeration
References
https://gitlab.com/NTPsec/ntpsec/-/commit/62a454f6fcb6f2dcc8d5866f6558905ebdb7dd69
https://gitlab.com/NTPsec/ntpsec/-/work_items/895