{"affected":[{"defaultStatus":"unaffected","product":"NTPsec","source":"CNA: GitLab","vendor":"NTPsec","versions":[{"lessThan":"1.2.5","status":"affected","version":"1.1.4","versionType":"semver"}]}],"cveId":"CVE-2026-121506","cwes":["CWE-787"],"description":"An out-of-bounds read and write in NTS client extension field parsing (extens_client_recv) in NTPsec before 1.2.5 allows a remote attacker who can send NTP server-mode replies to an NTS client to corrupt heap memory and crash ntpd, and, combined with the NTS-KE client out-of-bounds read fixed in 1.2.4, to bypass NTS authentication and set the client's time, via an NTS Authenticator and Encrypted Extension Fields field whose nonce length exceeds the field.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.4,"severity":"high","source":"CNA: GitLab","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"}],"modifiedAt":1793719768236,"publishedAt":1793715444651,"references":[{"source":"CNA: GitLab","tags":[],"url":"https://gitlab.com/NTPsec/ntpsec/-/commit/0a36941e499d533dfbc3fb6b1fcd8c367679d719"},{"source":"CNA: GitLab","tags":[],"url":"https://gitlab.com/NTPsec/ntpsec/-/work_items/902"}],"remediation":[{"kind":"fix","source":"CNA: GitLab","text":"Upgrade to version 1.2.5 or above."}],"revision":"195f1601b7a3b6643688ef36db212113d9276f4184370af8f5a789a70a45af24","sources":[{"modifiedAt":1793719768236,"name":"CNA: GitLab","retrievedAt":1793722170926,"url":"https://www.cve.org/CVERecord?id=CVE-2026-121506"}],"ssvc":{"assessedAt":1793718917727,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Out-of-bounds Write in NTPsec","updatedAt":1793722170926}