What’s Vulnerable › Vulnerabilities

CVE-2026-102485: Out-of-bounds Read in ntpsec

• Severity: medium (CVSS 5.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-21 · updated 2026-10-29
• Weakness: CWE-125

Description

Out-of-bounds read in the Motorola Oncore refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the GPS receiver's serial data to crash ntpd or disclose memory via a PPS Control (@@Gc) reply with an out-of-range mode byte.

Affected products

• ntpsec: before 1.2.6 — fixed in 1.2.6

How to fix

Upgrade to a fixed version: ntpsec 1.2.6. Check the vendor advisory for mitigations.

References

• https://gitlab.com/NTPsec/ntpsec/-/commit/22a09b3aec58831a9e4a008f3f22caa155f969c2
• https://gitlab.com/NTPsec/ntpsec/-/work_items/895

Get alerted when CVE-2026-102485 or the next vulnerability affects your stack