CVE-2026-102484

medium

Description

Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the Telephone JJY time source to corrupt memory or crash ntpd via more than six time replies.

References

https://gitlab.com/NTPsec/ntpsec/-/work_items/895

https://gitlab.com/NTPsec/ntpsec/-/commit/62a454f6fcb6f2dcc8d5866f6558905ebdb7dd69

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-107310

Details

Source: Mitre, NVD

Published: 2026-10-21

Updated: 2026-10-22

Risk Information

CVSS v2

Base Score: 6.8

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C

Severity: Medium

CVSS v3

Base Score: 6.4

Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H