CVE-2026-102484: ntpsec Heap-based Buffer Overflow
CVSS: 6.4v3.1MediumReceived
AliasesDEBIAN-CVE-2026-102484
Published 21-10-2026Last modified 21-10-2026
Vulnerability summary
CVE-2026-102484 is a medium (CVSS 6.4) Heap-based Buffer Overflow vulnerability in ntpsec.
CVSS score
6.4/10
010
Medium · v3.1 (CVE.org)EPSS score
Not scored
0%100%
No EPSS score yetKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 21-10-2026PublishedVulnerability first disclosed.
Description
Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the Telephone JJY time source to corrupt memory or crash ntpd via more than six time replies.
CVSS metrics
2 scores · 2 sources · 1 versionMedium 6.4Preferred score · CVE.org (CNA)
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:HSourcesAll 2 agree
- NVDNIST6.4MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- ntpsecAll versions (No fix recorded)
Ntpsec1 product
- ntpsec< 1.2.6
2 vendors · 2 products
