---
id: CVE-2026-102484
title: Heap-based Buffer Overflow in ntpsec
summary: >-
  Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before
  1.2.6 allows an attacker who controls the Telephone JJY time source to corrupt
  memory or crash ntpd via more than six time replies.
severity: medium
cvss: 6.4
cvssVector: 'CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-122
vendor: NTPsec
product: ntpsec
affected:
  - ntpsec < 1.2.6
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T15:03:46.313Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-102484'
references:
  - url: 'https://gitlab.com/NTPsec/ntpsec/-/work_items/895'
  - url: >-
      https://gitlab.com/NTPsec/ntpsec/-/commit/62a454f6fcb6f2dcc8d5866f6558905ebdb7dd69
tags:
  - cve.org
ingestedAt: '2026-10-21T16:05:17.711Z'
---

## Overview

Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the Telephone JJY time source to corrupt memory or crash ntpd via more than six time replies.

## Affected

- `ntpsec < 1.2.6`

## Remediation

Upgrade to version 1.2.6