CVE-2026-102484CWE-122

CVE-2026-102484

Medium · published October 21, 2026

CVSS v3.1
6.4
EPSS
0%
Percentile
17.4
In the wild
Unconfirmed
What it is

Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the Telephone JJY time source to corrupt memory or crash ntpd via more than six time replies.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00264 · 17.4th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2026-10-21T20:17Z
References (2)
https://gitlab.com/NTPsec/ntpsec/-/commit/62a454f6fcb6f2dcc8d5866f6558905ebdb7dd69 · [email protected]https://gitlab.com/NTPsec/ntpsec/-/work_items/895 · [email protected]
EPSS history
Timeline
  • 23 OCT 03:54Z
    EPSS moved — → 0%
    epss
  • 21 OCT 15:03Z
    Heap-based Buffer Overflow in ntpsec
    cvelistv5
  • 21 OCT 15:03Z
    Heap-based Buffer Overflow in ntpsec
    cvelistv5