CVE-2026-18321
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
In NTPsec, a buffer overflow in the Zyfer reference clock driver allows a local attacker to crash the ntpd process.
Risk Assessment
A local attacker can crash the NTP service, potentially disrupting time synchronization across the network and affecting other time-dependent services.
Recommendation
Apply a patch from NTPsec or update to a version that includes the fix (if available).
Other vulnerabilities in NTPsec
See all- CVE-2026-121506High
An out-of-bounds read and write in NTS client extension field parsing (extens_client_recv) in NTPsec before 1.2.5 allows a remote attacker who can send NTP server-mode replies to an NTS client to corrupt heap memory and crash ntpd, and, combined with the NTS-KE client out-of-bounds read fixed in 1.2.4, to bypass NTS authentication and set the client's time.
- CVE-2026-121505Low
An out-of-bounds read in the NTS-KE client response parser (nts_client_process_response_core) in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the client then sends in cleartext as NTS cookies, via an NTS-KE record whose declared length exceeds the data received.
- CVE-2026-102484Medium
Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the Telephone JJY time source to corrupt memory or crash ntpd via more than six time replies.
Original NVD description (English source)
Buffer overflow in NTPsec's Zyfer refclock allows local attacker to crash ntpd
Vulnerability data from NVD (NIST) · CISA KEV · EPSS