Is CVE-2026-121506 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121506 being exploited in the wild.

How severe is CVE-2026-121506?

High severity, with a CVSS score of 7.4, published 3 November 2026.

Is there a fix for CVE-2026-121506?

Yes: fixed in 1.2.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-121506 attacked?

It is attacked over the network.

Am I affected by CVE-2026-121506?

Check whether you run Ntpsec at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121506: NTPsec out-of-bounds read/write in NTS client extension parsing

CVE-2026-121506 · Severity: high · CVSS 7.4 · Published 2026-11-03

NTPsec is a network time protocol implementation used to synchronize system clocks across networks. A flaw in how NTPsec processes NTS (Network Time Security) extension fields allows a remote attacker to corrupt memory and crash the ntpd daemon. When combined with a prior vulnerability, an attacker can bypass authentication and manipulate the client's system time.

Technologies: Ntpsec. Vendors: Ntpsec.

Quick answers

Is CVE-2026-121506 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121506 being exploited in the wild.
How severe is CVE-2026-121506?: High severity, with a CVSS score of 7.4, published 3 November 2026.
Which products and versions are affected?: Ntpsec before 1.2.5.
Is there a fix for CVE-2026-121506?: Yes: fixed in 1.2.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121506 attacked?: It is attacked over the network.
Am I affected by CVE-2026-121506?: Check whether you run Ntpsec at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.2.5

Technical details

The vulnerability is an out-of-bounds read and write in the extens_client_recv function when parsing NTS Authenticator and Encrypted Extension Fields (AEEF). The flaw occurs when processing nonce length fields that exceed the allocated buffer size. An unauthenticated remote attacker can send specially crafted NTP server-mode replies to trigger heap memory corruption and denial of service; chained with CVE-2026-121505 (NTS-KE client out-of-bounds read), authentication can be bypassed to set arbitrary time values.

Affected products

NTPsec NTPsec before 1.2.5

Timeline

2026-11-03: disclosed
2025-05-01: patched: Commit 0a36941e adds length checks to extens_client_recv

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.