CVE-2026-121506
Last modified
CVE-2026-121506 is a high-severity vulnerability rated 7.4/10 on the CVSS scale. An out-of-bounds read and write in NTS client extension field parsing (extens_client_recv) in NTPsec before 1.2.5 allows a remote attacker who can send NTP server-mode replies to an NTS client to corrupt heap memory and crash ntpd, and, combined with the NTS-KE client out-of-bounds read fixed in 1.2.4, to bypass NTS authentication and set the client's time, via an NTS Authenticator and Encrypted Extension Fields field whose nonce length exceeds the field..
Description
An out-of-bounds read and write in NTS client extension field parsing (extens_client_recv) in NTPsec before 1.2.5 allows a remote attacker who can send NTP server-mode replies to an NTS client to corrupt heap memory and crash ntpd, and, combined with the NTS-KE client out-of-bounds read fixed in 1.2.4, to bypass NTS authentication and set the client's time, via an NTS Authenticator and Encrypted Extension Fields field whose nonce length exceeds the field.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| NTPsec | NTPsec | >= 1.1.4, < 1.2.5 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-121506?
How severe is CVE-2026-121506?
How do I fix CVE-2026-121506?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-121489Improper Limitation of a Pathname to a Restricted Directory …10
- CVE-2026-1215The MMA Call Tracking plugin for WordPress is vulnerable to …4.3
- CVE-2026-12150IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.4…7
- CVE-2026-121501A vulnerability was determined in mathurvishal CloudClassroo…6.3
- CVE-2026-121502A vulnerability was identified in mathurvishal CloudClassroo…7.3
- CVE-2026-121505An out-of-bounds read in the NTS-KE client response parser (…3.7
- CVE-2026-121507Double Free in µD3TN BPv6 Fragmenter Block Duplication allow…5.9
- CVE-2026-121508Use-After-Free in µD3TN BPv6 Fragmenter Cleanup allows Unaut…5.9
- CVE-2026-121509A security flaw has been discovered in Headless CMS Plugin u…5.3
- CVE-2026-12151Impact: The undici WebSocket client enforces maxPayloadSize …7.5
- CVE-2026-121510Remote Unauthenticated Heap Out-of-Bounds Write in µD3TN BPv…7.5
- CVE-2026-121511Heap Out-of-Bounds Read in µD3TN BPv6/BPv7 Fragmenter allows…7.1
Are you affected by CVE-2026-121506?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST