CVE-2026-121505 PUBLISHED

Out-of-bounds Read in NTPsec

Assigner: GitLab
Reserved: 03.11.2026 Published: 03.11.2026 Updated: 03.11.2026

An out-of-bounds read in the NTS-KE client response parser (nts_client_process_response_core) in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the client then sends in cleartext as NTS cookies, via an NTS-KE record whose declared length exceeds the data received.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 3.7

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	Low
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	NTPsec
Product	NTPsec
Versions	Default: unaffected affected from 1.1.4 to 1.2.4 (excl.)

Solutions

Upgrade to version 1.2.4 or above.

Credits

Artem Nasonov (Astra Linux) found and fixed the issue; Erica Windisch (Cyberdione Labs) analyzed its impact finder

References

Problem Types

CWE-125: Out-of-bounds Read CWE