An out-of-bounds read in the NTS-KE client response parser (nts_client_process_response_core) in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the client then sends in cleartext as NTS cookies, via an NTS-KE record whose declared length exceeds the data received.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
Upgrade to version 1.2.4 or above.
Workaround
No workaround given by the vendor.
References
History
Tue, 03 Nov 2026 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An out-of-bounds read in the NTS-KE client response parser (nts_client_process_response_core) in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the client then sends in cleartext as NTS cookies, via an NTS-KE record whose declared length exceeds the data received. | |
| Title | Out-of-bounds Read in NTPsec | |
| Weaknesses | CWE-125 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitLab
Published:
Updated: 2026-11-03T14:17:09.654Z
Reserved: 2026-11-03T14:16:59.661Z
Link: CVE-2026-121505
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-11-03T15:17:37.557
Modified: 2026-11-03T16:15:28.703
Link: CVE-2026-121505
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses