Buffer Overflow Vulnerability in NTPsec's Zyfer Refclock
CVE-2026-18321

4.7MEDIUM

Key Information:

Vendor

Ntpsec

Status
Ntpsec
Vendor
CVE Published:
31 July 2026

What is CVE-2026-18321?

A buffer overflow vulnerability exists in the Zyfer refclock component of NTPsec, which can be exploited by local attackers. This flaw allows attackers to manipulate memory buffers, potentially crashing the ntpd service and disrupting time synchronization on affected systems. Organizations using NTPsec are advised to update to the latest versions to mitigate this risk.

Affected Version(s)

ntpsec 0 < 1.2.5

References

https://gitlab.com/NTPsec/ntpsec/-/work_items/890

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Youngjoon Kim of Team Atlanta
.