{"id":"CVE-2026-121505","title":"Out-of-bounds Read in NTPsec","summary":"An out-of-bounds read in the NTS-KE client response parser (nts_client_process_response_core) in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the clien…","severity":"low","cvss":3.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-125"],"vendor":"NTPsec","product":"NTPsec","affected":["NTPsec >= 1.1.4 < 1.2.4"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-03T18:11:50.547327Z"},"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T18:12:00.515Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-121505","references":[{"url":"https://gitlab.com/NTPsec/ntpsec/-/commit/caf0eb5df3c6ddbfc2941389bff0f9146835c021"},{"url":"https://gitlab.com/NTPsec/ntpsec/-/work_items/836"},{"url":"https://gitlab.com/NTPsec/ntpsec/-/work_items/902"}],"tags":["cve.org"],"epss":0.00293,"epssPercentile":0.22058,"ingestedAt":"2026-11-05T20:33:06.341Z","slug":"CVE-2026-121505","body":"## Overview\n\nAn out-of-bounds read in the NTS-KE client response parser (nts_client_process_response_core) in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the client then sends in cleartext as NTS cookies, via an NTS-KE record whose declared length exceeds the data received.\n\n## Affected\n\n- `NTPsec >= 1.1.4 < 1.2.4`\n\n## Remediation\n\nUpgrade to version 1.2.4 or above.","depth":"sunlit","depthScore":20,"depthScoreParts":{"impact":20.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}