---
id: CVE-2026-121505
title: Out-of-bounds Read in NTPsec
summary: >-
  An out-of-bounds read in the NTS-KE client response parser
  (nts_client_process_response_core) in NTPsec before 1.2.4 allows a malicious
  NTS-KE server to read the client's stack memory, including pointers that
  defeat ASLR, which the clien…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-125
vendor: NTPsec
product: NTPsec
affected:
  - NTPsec >= 1.1.4 < 1.2.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T18:11:50.547327Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T18:12:00.515Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121505'
references:
  - url: >-
      https://gitlab.com/NTPsec/ntpsec/-/commit/caf0eb5df3c6ddbfc2941389bff0f9146835c021
  - url: 'https://gitlab.com/NTPsec/ntpsec/-/work_items/836'
  - url: 'https://gitlab.com/NTPsec/ntpsec/-/work_items/902'
tags:
  - cve.org
epss: 0.00293
epssPercentile: 0.22058
ingestedAt: '2026-11-05T20:33:06.341Z'
---

## Overview

An out-of-bounds read in the NTS-KE client response parser (nts_client_process_response_core) in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the client then sends in cleartext as NTS cookies, via an NTS-KE record whose declared length exceeds the data received.

## Affected

- `NTPsec >= 1.1.4 < 1.2.4`

## Remediation

Upgrade to version 1.2.4 or above.