PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9312 Microsoft CVE debrief

CVE-2016-9312 describes a denial-of-service condition in ntpd from NTP versions before 4.2.8p9 when running on Windows. The NVD record classifies it as network-reachable, unauthenticated, and high impact to availability, with no confidentiality or integrity impact. The published references point to the NTP release notes, issue tracker, and advisory materials for remediation.

Vendor
Microsoft
Product
CVE-2016-9312
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-13
Original CVE updated
2026-05-13
Advisory published
2017-01-13
Advisory updated
2026-05-13

Who should care

Administrators running ntpd from NTP on Windows, especially systems that accept UDP traffic from untrusted networks. Security teams should also care if NTP is used on servers or appliances exposed to the internet or broad internal network segments.

Technical summary

The NVD description states that ntpd in NTP before 4.2.8p9, when running on Windows, can be driven into denial of service by a large UDP packet. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, and the listed weakness is CWE-399 (resource management / resource consumption class). The vulnerable NTP component is identified in NVD CPE data, while the Windows platform context is mentioned in the vulnerability description.

Defensive priority

High for exposed NTP services on Windows; lower but still relevant for segmented or internal-only deployments. Because the issue is network-triggered and unauthenticated, exposure reduction and version remediation should be prioritized.

Recommended defensive actions

  • Upgrade NTP/ntpd to 4.2.8p9 or later on affected Windows systems.
  • Inventory hosts running ntpd and confirm exact versions, not just package names.
  • Restrict UDP access to NTP services to trusted networks only where feasible.
  • Monitor Windows NTP hosts for unexpected service interruption or repeated restarts.
  • Review vendor and NTP project advisories for any platform-specific remediation guidance.

Evidence notes

Primary evidence comes from the NVD record and CVE reference set supplied in the source item. The description explicitly says the issue affects ntpd in NTP before 4.2.8p9 on Windows and can cause denial of service via a large UDP packet. NVD assigns CVSS 3.0 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H and CWE-399. The supplied reference list includes NTP release notes, an NTP issue tracker page, an NTP security notice, and CERT/CC advisory material. No KEV entry was provided.

Official resources

Originally published in the CVE/NVD record on 2017-01-13. The provided source item was later modified on 2026-05-13, but that is not the original disclosure date.