CVE-2026-102484 NTPsec CVE debrief

Who should care

Defenders responsible for NTPsec ntpd installations, especially those using the JJY refclock driver, should assess exposure and prioritize verification and remediation efforts. This includes reviewing the current configuration, assessing the potential impact, and planning for updates or compensating controls. Additionally, security teams and vulnerability management teams should be aware of this vulnerability and its potential impacts on their systems.

Why it matters

This vulnerability allows an attacker controlling the Telephone JJY time source to potentially corrupt memory or crash ntpd service in NTPsec ntpd versions before 1.2.6. Defenders should prioritize verifying exposure, especially for JJY refclock driver usage, and assess the need for updates or compensating controls.

• Potential memory corruption or crash of ntpd service
• Possible disruption of time synchronization services
• Need for verification of JJY refclock driver usage and exposure
• Priority for updating to version 1.2.6 or later

Technical summary

The JJY refclock driver in NTPsec ntpd before 1.2.6 is vulnerable to a heap-based buffer overflow. An attacker who controls the Telephone JJY time source can send more than six time replies to corrupt memory or crash ntpd. This vulnerability is related to the JJY refclock driver and affects NTPsec ntpd versions before 1.2.6. Defenders should prioritize verifying exposure of NTPsec ntpd installations to this vulnerability, especially those using the JJY refclock driver, and assess the need for updates or compensating controls.

Defensive priority

Defenders should prioritize verifying exposure of NTPsec ntpd installations to this vulnerability, especially those using the JJY refclock driver, and assess the need for updates or compensating controls.

Recommended defensive actions

• Verify NTPsec ntpd installations for exposure to this vulnerability
• Assess the need for updates to version 1.2.6 or later
• Consider compensating controls for JJY refclock driver usage
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information on this vulnerability. Supplemental sources include references to GitLab work items and commits related to the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.