CVE-2026-121506 in NTPsec
Summary
by MITRE • 11/03/2026
An out-of-bounds read and write in NTS client extension field parsing (extens_client_recv) in NTPsec before 1.2.5 allows a remote attacker who can send NTP server-mode replies to an NTS client to corrupt heap memory and crash ntpd, and, combined with the NTS-KE client out-of-bounds read fixed in 1.2.4, to bypass NTS authentication and set the client's time, via an NTS Authenticator and Encrypted Extension Fields field whose nonce length exceeds the field.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified involves critical memory safety failures within the Network Time Security extension parsing logic of the NTPsec implementation prior to version 1.2.5. Specifically, the function extens_client_recv contains flaws that permit both out-of-bounds read and write operations when processing client-side extensions in response packets from an NTP server-mode reply. These memory corruption issues arise because the parser fails to adequately validate the length of fields against their allocated buffer boundaries before accessing or modifying data structures. This lack of rigorous bounds checking allows a remote attacker, who possesses the capability to inject crafted NTP server-mode replies into the communication stream between an NTS client and its intended time source, to manipulate heap memory directly. The immediate operational consequence of these out-of-bounds writes is the corruption of adjacent memory regions, which typically leads to the termination or crash of the ntpd process due to segmentation faults or other fatal exceptions triggered by invalid memory access patterns.
Beyond simple denial of service through application crashes, this vulnerability presents a severe security risk when considered in conjunction with related issues fixed in earlier patches such as version 1.2.4. The combination of the out-of-bounds read and write flaws enables an attacker to bypass Network Time Security authentication mechanisms entirely. By crafting specific NTS Authenticator and Encrypted Extension Fields where the nonce length exceeds the defined field size, a malicious actor can manipulate the parsing logic to execute arbitrary memory operations that effectively neutralize the integrity checks provided by NTS. This allows the attacker to forge time synchronization responses, thereby setting the client's system clock to an arbitrary value of their choosing. Such manipulation undermines the fundamental purpose of Network Time Security, which is to ensure both confidentiality and authenticity of time data, potentially facilitating further attacks such as certificate validation failures, log tampering, or bypassing time-based access controls in dependent systems.
From a classification perspective, this vulnerability aligns with CWE-125 Out-of-bounds Read and CWE-787 Out-of-bounds Write, which describe the improper limitation of an array or buffer's boundary during read or write operations respectively. The exploitation technique leverages these memory corruption flaws to achieve unauthorized state modification, mapping closely to ATT&CK techniques related to Defense Evasion through privilege escalation or access token manipulation in broader contexts, though here it specifically targets authentication bypass and time source spoofing. The ability to set the client's time arbitrarily places this vulnerability within the scope of Time Manipulation attacks, which can have cascading effects on distributed systems relying on synchronized clocks for security protocols like Kerberos or TLS certificate validation.
Mitigation strategies require immediate upgrading of NTPsec to version 1.2.5 or later, where these parsing logic errors and associated memory safety issues have been addressed through stricter input validation and bounds checking in the extens_client_recv function. Administrators should also ensure that their network infrastructure employs strict filtering rules to prevent untrusted hosts from injecting NTP server-mode replies into client communication streams until all systems are patched. Additionally, monitoring for unusual spikes in ntpd process restarts or memory corruption errors can serve as an indicator of potential exploitation attempts in environments where patching cannot be applied immediately.