{"id":"CVE-2026-102484","summary":"Heap-based Buffer Overflow in ntpsec","details":"Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the Telephone JJY time source to corrupt memory or crash ntpd via more than six time replies.","modified":"2026-10-22T07:26:21.994470875Z","published":"2026-10-21T15:03:46.313Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102484.json","unresolved_ranges":[{"extracted_events":[{"range":[{"fixed":"1.2.6"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"}]},{"extracted_events":[{"range":[{"fixed":"1.2.6"}],"source":"DESCRIPTION"}]}],"cna_assigner":"GitLab","cwe_ids":["CWE-122"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102484.json"},{"type":"PACKAGE","url":"https://gitlab.com/NTPsec/ntpsec"},{"type":"FIX","url":"https://gitlab.com/NTPsec/ntpsec/-/commit/62a454f6fcb6f2dcc8d5866f6558905ebdb7dd69"},{"type":"WEB","url":"https://gitlab.com/NTPsec/ntpsec/-/work_items/895"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102484"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://gitlab.com/ntpsec/ntpsec","events":[{"introduced":"0"},{"fixed":"62a454f6fcb6f2dcc8d5866f6558905ebdb7dd69"}],"database_specific":{"extracted_events":[{"range":[{"fixed":"62a454f6fcb6f2dcc8d5866f6558905ebdb7dd69"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["NTPsec_1_2_5","NTPsec_1_2_4","NTPsec_1_2_3","NTPsec_1_2_2","NTPsec_1_2_1","NTPsec_1_2_0","NTPsec_1_1_9","NTPsec_1_1_8","NTPsec_1_1_7","NTPsec_1_1_6","NTPsec_1_1_5","NTPsec_1_1_4","NTPsec_1_1_3","NTPsec_1_1_2","NTPsec_1_1_1","NTPsec_1_1_0","NTPsec_1_0_0","NTPsec_0_9_8","NTPsec_0_9_7","git-conversion","NTP_4_3_34","NTP_4_3_33","NTP_4_3_32","NTP_4_3_31","NTP_4_3_30","NTP_4_3_29","NTP_4_3_28","NTP_4_3_27","NTP_4_3_26","NTP_4_3_25","NTP_4_3_24","NTP_4_3_14","NTP_4_3_13","NTP_4_3_12","NTP_4_3_11","NTP_4_3_10","NTP_4_3_9","NTP_4_3_8","NTP_4_3_7","NTP_4_3_6","NTP_4_3_5","NTP_4_3_4","NTP_4_3_3","NTP_4_3_2","NTP_4_3_1","NTP_4_3_0","NTP_4_2_7P484_RC","NTP_4_2_7P483","NTP_4_2_7P482","NTP_4_2_7P481","NTP_4_2_7P480","NTP_4_2_7P479","NTP_4_2_7P478","NTP_4_2_7P477","NTP_4_2_7P476","NTP_4_2_7P475","NTP_4_2_7P474","NTP_4_2_7P473","NTP_4_2_7P472","NTP_4_2_7P471","NTP_4_2_7P470","NTP_4_2_7P469","NTP_4_2_7P468","NTP_4_2_7P467","NTP_4_2_7P466","NTP_4_2_7P465","NTP_4_2_7P464","NTP_4_2_7P463","NTP_4_2_7P462","NTP_4_2_7P457","NTP_4_2_7P453","NTP_4_2_7P452","NTP_4_2_7P451","NTP_4_2_7P450","NTP_4_2_7P449","NTP_4_2_7P448","NTP_4_2_7P447","NTP_4_2_7P446","NTP_4_2_7P445","NTP_4_2_7P444","NTP_4_2_7P443","NTP_4_2_7P421","NTP_4_2_7P420","NTP_4_2_7P419","NTP_4_2_7P418","NTP_4_2_7P417","NTP_4_2_7P415","NTP_4_2_7P414","NTP_4_2_7P413","NTP_4_2_7P412","NTP_4_2_7P411","NTP_4_2_7P410","NTP_4_2_7P408","NTP_4_2_7P406","NTP_4_2_7P405","NTP_4_2_7P404","NTP_4_2_7P403","NTP_4_2_7P402","NTP_4_2_7P399","NTP_4_2_7P390","NTP_4_2_7P398","NTP_4_2_7P397","NTP_4_2_7P396","NTP_4_2_7P395","NTP_4_2_7P394","NTP_4_2_7P391","NTP_4_2_7P388","NTP_4_2_7P389","NTP_4_2_7P387","NTP_4_2_7P383","NTP_4_2_7P382","NTP_4_2_7P381","NTP_4_2_7P379","NTP_4_2_7P378","NTP_4_2_7P377","NTP_4_2_7P376","NTP_4_2_7P375","NTP_4_2_7P368","NTP_4_2_7P365","NTP_4_2_7P367","NTP_4_2_7P366","NTP_4_2_7P364","NTP_4_2_7P363","NTP_4_2_7P362","NTP_4_2_7P361","NTP_4_2_7P360","NTP_4_2_7P359","NTP_4_2_7P358","NTP_4_2_7P357","NTP_4_2_7P356","NTP_4_2_7P355","NTP_4_2_7P354","NTP_4_2_7P353","NTP_4_2_7P352","NTP_4_2_7P351","NTP_4_2_7P350","NTP_4_2_7P349","NTP_4_2_7P348","NTP_4_2_7P347","NTP_4_2_7P346","NTP_4_2_7P345","NTP_4_2_7P344","NTP_4_2_7P339","NTP_4_2_7P337","NTP_4_2_7P336","NTP_4_2_7P335","NTP_4_2_7P334","NTP_4_2_7P333","NTP_4_2_7P332","NTP_4_2_7P331","NTP_4_2_7P330","NTP_4_2_7P329","NTP_4_2_7P306","NTP_4_2_7P305","NTP_4_2_7P304","NTP_4_2_7P303","NTP_4_2_7P302","NTP_4_2_7P301","NTP_4_2_7P300","NTP_4_2_7P299","NTP_4_2_7P298","NTP_4_2_7P297","NTP_4_2_7P296","NTP_4_2_7P270","NTP_4_2_7P269","NTP_4_2_7P255","NTP_4_2_7P254","NTP_4_2_7P253","NTP_4_2_7P252","NTP_4_2_7P251","NTP_4_2_7P250","NTP_4_2_7P249","NTP_4_2_7P248","NTP_4_2_7P247","NTP_4_2_7P246","NTP_4_2_7P245","NTP_4_2_7P244","NTP_4_2_7P243","NTP_4_2_7P242","NTP_4_2_7P241","NTP_4_2_7P240","NTP_4_2_7P237","NTP_4_2_7P239","NTP_4_2_7P238","NTP_4_2_7P236","NTP_4_2_7P235","NTP_4_2_7P234","NTP_4_2_7P233","NTP_4_2_7P232","NTP_4_2_7P231","NTP_4_2_7P230","NTP_4_2_7P229","NTP_4_2_7P228","NTP_4_2_7P212","NTP_4_2_7P211","NTP_4_2_7P210","NTP_4_2_7P209","NTP_4_2_7P208","NTP_4_2_7P207","NTP_4_2_7P206","NTP_4_2_7P205","NTP_4_2_7P204","NTP_4_2_7P202","NTP_4_2_7P201","NTP_4_2_7P200","NTP_4_2_7P199","NTP_4_2_7P198","NTP_4_2_7P197","NTP_4_2_7P196","NTP_4_2_7P195","NTP_4_2_7P192","NTP_4_2_7P191","NTP_4_2_7P190","NTP_4_2_7P189","NTP_4_2_7P188","NTP_4_2_7P187","NTP_4_2_7P186","NTP_4_2_7P185","NTP_4_2_7P184","NTP_4_2_7P183","NTP_4_2_7P182","NTP_4_2_7P179","NTP_4_2_7P178","NTP_4_2_7P177","NTP_4_2_7P176","NTP_4_2_7P174","NTP_4_2_7P168","NTP_4_2_7P167","NTP_4_2_7P166","NTP_4_2_7P165","NTP_4_2_7P164","NTP_4_2_7P163","NTP_4_2_7P162","NTP_4_2_7P161","NTP_4_2_7P160","NTP_4_2_7P132","NTP_4_2_7P131","NTP_4_2_7P111","NTP_4_2_7P110","NTP_4_2_7P109","NTP_4_2_7P108","NTP_4_2_7P107","NTP_4_2_7P106","NTP_4_2_7P105","NTP_4_2_7P104","NTP_4_2_7P103","NTP_4_2_7P102","NTP_4_2_7P101","NTP_4_2_7P100","NTP_4_2_7P99","NTP_4_2_7P98","NTP_4_2_7P97","NTP_4_2_7P96","NTP_4_2_7P95","NTP_4_2_7P94","NTP_4_2_7P93","NTP_4_2_7P92","NTP_4_2_7P91","NTP_4_2_7P90","NTP_4_2_7P89","NTP_4_2_7P86","NTP_4_2_7P85","NTP_4_2_7P84","NTP_4_2_7P81","NTP_4_2_7P80","NTP_4_2_7P79","NTP_4_2_7P78","NTP_4_2_7P77","NTP_4_2_7P76","NTP_4_2_7P75","NTP_4_2_7P35","NTP_4_2_7P34","NTP_4_2_7P33","NTP_4_2_7P32","NTP_4_2_7P31","NTP_4_2_7P30","NTP_4_2_7P27","NTP_4_2_7P26","NTP_4_2_7P25","NTP_4_2_7P24","NTP_4_2_7P20","NTP_4_2_7P19","NTP_4_2_7P18","NTP_4_2_7P17","NTP_4_2_7P16","NTP_4_2_7P15","NTP_4_2_7P14","NTP_4_2_5P250_RC","NTP_4_2_5P249_RC","NTP_4_2_5P248_RC","NTP_4_2_5P232_RC","NTP_4_2_5P231_RC","NTP_4_2_5P230_RC","NTP_4_2_5P229","NTP_4_2_5P228","NTP_4_2_5P227","NTP_4_2_5P226","NTP_4_2_5P225","NTP_4_2_5P224","NTP_4_2_5P223","NTP_4_2_5P222","NTP_4_2_5P220","NTP_4_2_5P219","NTP_4_2_5P218","NTP_4_2_5P217","NTP_4_2_5P216","NTP_4_2_5P215","NTP_4_2_5P214","NTP_4_2_5P213","NTP_4_2_5P212","NTP_4_2_5P210","NTP_4_2_5P209","NTP_4_2_5P205","NTP_4_2_5P204","NTP_4_2_5P203","NTP_4_2_5P202","NTP_4_2_5P201","NTP_4_2_5P199","NTP_4_2_5P198","NTP_4_2_5P180","NTP_4_2_5P197","NTP_4_2_5P196","NTP_4_2_5P195","NTP_4_2_5P194","NTP_4_2_5P193","NTP_4_2_5P192","NTP_4_2_5P191","NTP_4_2_5P190","NTP_4_2_5P189","NTP_4_2_5P185","NTP_4_2_5P188","NTP_4_2_5P187","NTP_4_2_5P182","NTP_4_2_5P184","NTP_4_2_5P183","NTP_4_2_5P181","NTP_4_2_5P179","NTP_4_2_5P178","NTP_4_2_5P177","NTP_4_2_5P176","NTP_4_2_5P175","NTP_4_2_5P172","NTP_4_2_5P171","NTP_4_2_5P170","NTP_4_2_5P169","NTP_4_2_5P168","NTP_4_2_5P166","NTP_4_2_5P150","NTP_4_2_5P145","NTP_4_2_5P144","NTP_4_2_5P143","NTP_4_2_5P142","NTP_4_2_5P118","NTP_4_2_5P116","NTP_4_2_5P115","NTP_4_2_5P114","NTP_4_2_5P113","NTP_4_2_5P112","NTP_4_2_5P111","NTP_4_2_5P110","NTP_4_2_5P109","NTP_4_2_5P108","NTP_4_2_5P107","NTP_4_2_5P106","NTP_4_2_5P105","NTP_4_2_5P104","NTP_4_2_5P103","NTP_4_2_5P101","NTP_4_2_5P100","NTP_4_2_5P98","NTP_4_2_5P97","NTP_4_2_5P95","NTP_4_2_5P93","NTP_4_2_5P92","NTP_4_2_5P91","NTP_4_2_5P90","NTP_4_2_5P89","NTP_4_2_5P88","NTP_4_2_5P87","NTP_4_2_5P86","NTP_4_2_5P85","NTP_4_2_5P84","NTP_4_2_5P83","NTP_4_2_5P82","NTP_4_2_5P81","NTP_4_2_5P80","NTP_4_2_5P79","NTP_4_2_5P78","NTP_4_2_5P77","NTP_4_2_5P76","NTP_4_2_5P75","NTP_4_2_5P73","NTP_4_2_5P72","NTP_4_2_5P71","NTP_4_2_5P70","NTP_4_2_5P69","NTP_4_2_5P66","NTP_4_2_5P65","NTP_4_2_5P64","NTP_4_2_5P63","NTP_4_2_5P62","NTP_4_2_5P61","NTP_4_2_5P60","NTP_4_2_5P59","NTP_4_2_5P58","NTP_4_2_5P57","NTP_4_2_5P56","NTP_4_2_5P53","NTP_4_2_5P52","NTP_4_2_5P51","NTP_4_2_5P44","NTP_4_2_5P39","NTP_4_2_5P43","NTP_4_2_5P42","NTP_4_2_5P41","NTP_4_2_5P40","NTP_4_2_5P38","NTP_4_2_5P35","NTP_4_2_5P34","NTP_4_2_5P33","NTP_4_2_5P32","NTP_4_2_5P31","NTP_4_2_5P30","NTP_4_2_5P0","NTP_4_2_5","NTP_4_2_3P70_RC","NTP_4_2_3P69_RC","NTP_4_2_3P68_RC","NTP_4_2_3P67_RC","NTP_4_2_3P66_RC","NTP_4_2_3P65_RC","NTP_4_2_3P64_RC","NTP_4_2_3P63_RC","NTP_4_2_3P62_RC","NTP_4_2_3P61_RC","NTP_4_2_3P2","NTP_4_1_0","NTP_4_0_99M_RC3","NTP_4_0_99_M","NTP_4_0_99_K","NTP_4_0_99_J","PRE_CRYPTO","NTP_4_0_99_G","NTP_4_0_99_F","NTP_4_0_99_E","NTP_4_0_99_C","HMS_PRE_AC_214A_AUDIO","NTP_4_0_99_B","NTP_4_0_99_A","NTP_4_0_99","NTP_4_0_98_M","NTP_4_0_98_J","NTP_4_0_98_I","NTP_4_0_98_H","NTP_4_0_98_G","NTP_4_0_98_F","NTP_4_0_98_E","NTP_4_0_98_D","NTP_4_98_c","POST_NT_991015","PRE_NT_991015","NTP_4_0_98_A","NTP_4_0_98","NTP_4_0_97_F","NTP_4_0_97_E","NTP_4_0_97_D","NTP_4_0_97_C","NTP_4_0_97_B","NTP_4_0_97_A","NTP_4_0_97","NTP_4_0_96_P1","NTP_4_0_96","POST_ATT_Y2K","PRE_ATT_Y2K","NTP_4_0_95","NTP_4_0_94b","NTP_4_0_94"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102484.json","vanir_signatures":[{"id":"CVE-2026-102484-0cf1a210","signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/ntpsec/ntpsec@62a454f6fcb6f2dcc8d5866f6558905ebdb7dd69","target":{"function":"teljjy_conn_data","file":"ntpd/refclock_jjy.c"},"deprecated":false,"digest":{"function_hash":"216616226093146680179104162793159418302","length":4857}},{"digest":{"length":5396,"function_hash":"170769716594253157468369157914794101597"},"id":"CVE-2026-102484-1f0fed85","signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/ntpsec/ntpsec@62a454f6fcb6f2dcc8d5866f6558905ebdb7dd69","target":{"function":"jjy_receive_tristate_gpsclock01","file":"ntpd/refclock_jjy.c"},"deprecated":false},{"source":"https://gitlab.com/ntpsec/ntpsec@62a454f6fcb6f2dcc8d5866f6558905ebdb7dd69","target":{"file":"ntpd/refclock_jjy.c"},"deprecated":false,"digest":{"line_hashes":["142499790158908613316908222239967706370","185386145183728336234919592012620836591","252106753251926290604103041060546089002","313118493293479841220377769126656666028","29839050659006072859424745273737181077","309970778511628168492797303244145577459","219210456239170454793184069645571636335","30704856996564523938238042987824560298","1278369387749506408747100949136653284","26040729088671464188431254848258040748","56954587394226307021051820341664329115","173273482405662747651633809103293829703","148241426995447588575395802713839887794","163155859063254213136946191381772088730","35676073855286486921157399967466495680","332847009443548841367953780504605269467","166819006737856666078311786038334513454","320491105909675110078642192478760670361","327112073628974532278522484037285661513","132508637467783312861925213282524060872","84950083833363162620875203877968438038","246167077806715492857068547198933044354","127243554600310633141689268405990118956","8252418257015025628541157750259708462","78330880940301737082964177853036887627","187547109097558297549468384215342086771","228248883921935388382188946269002505600","329309924202821124676404682724571211458","141479921694770723667621931890030599168","93414215995126359639572464888621599716","132508637467783312861925213282524060872","272021443617013413548684582685222680937","189673563921352140318234956895273892019","279513917566354295719133258557938583829","173044525505599719830496217072009561942","253055736402491494901032980241532286466","146546853402386782080906797684827642041","97291013849918601985271472881322613625","305829372024822749668773001384428143259","108545308363371189320912055643816122433","227150543522373328435280037630872037696","272535263971173548058033059512073981216","107113598639029358777133686310632588617","241533067292655891310940491695194029222","29705331965999612006320013633270238561","220265725270705900446486651033064158826","56017230980561534731889194809818674883","3688180786602488133803188882292339204","332847009443548841367953780504605269467","166819006737856666078311786038334513454","320491105909675110078642192478760670361","327112073628974532278522484037285661513","132508637467783312861925213282524060872","78330880940301737082964177853036887627","187547109097558297549468384215342086771","333468171729924926644758188810154217156","329309924202821124676404682724571211458","141479921694770723667621931890030599168","93414215995126359639572464888621599716","132508637467783312861925213282524060872","272021443617013413548684582685222680937","189673563921352140318234956895273892019","279513917566354295719133258557938583829","173044525505599719830496217072009561942","200999072207885533577268123672918614933","19132374580687359944965810457687357880","232450992021884098516132379380868221409","263104877084025391057135400825341562452","190440403687808052913661515741382952292","295165354091473551052120315365561937767","330031153143190486048794101756034360611","288673223302806895087775845136462434495","31836119590877744074260206077932873310","146378922808290245983519507446147574699","310172017608391213767499715118643268699","45907555538411924493141079104185462212","132508637467783312861925213282524060872","97291013849918601985271472881322613625","305829372024822749668773001384428143259","108545308363371189320912055643816122433","227150543522373328435280037630872037696","224782759385738727535747996717747976119","258402273809342441644859843320933062075","30290565044837280952374134381436722039","211451437977737860296653883880824676059","23903730544917021795283466106223098011","63586217945527720222690524400964705230","67821185008537943592511058771889487548","234416288770713160922335174773802648191","251800649498692691272508537450792608860","150828520305925102826606406416939683054","200554421444601001425935905732262727941","234416288770713160922335174773802648191","251800649498692691272508537450792608860","150828520305925102826606406416939683054","23404822073266004306065939663857843106","77413229623174581488932920230573546027","10866646838370543256004525104629029178","156741142513204515187919058076593288789","3783100453785580074522598807088618745","329309924202821124676404682724571211458","141479921694770723667621931890030599168","138380284304003717491750505366989870225","207718215461108078564769040522939299889","11267910432897299266860475845246034384","321188121563265875119127278907548893666","217591308355579274622128073213724195964","6740050028535806197375975196812678853","336798303279121764541922908612735447711","100917746116178411895131957283209209439","65483359741571049652598194578557541326","297384330864187393456505825928427551668","46035457002184671412327299721745261283","109640595107376862222733932539215293578","213220219848474153979876361864301406530","309816178742258968239834603254533551327","31922215336467948890010697695962305295","279219444951616922694155078120309222607","142114200280879509726681331287923817691","37542609389115776592247782578329585579","273858491861207829527503310022132025050","81223189741333438926722790657626256933"],"threshold":0.9},"id":"CVE-2026-102484-a002fbda","signature_type":"Line","signature_version":"v1"},{"source":"https://gitlab.com/ntpsec/ntpsec@62a454f6fcb6f2dcc8d5866f6558905ebdb7dd69","target":{"file":"ntpd/refclock_jjy.c","function":"jjy_receive_tristate_jjy01"},"deprecated":false,"digest":{"function_hash":"41018396077462611098259439099958353726","length":4968},"id":"CVE-2026-102484-df4001f7","signature_type":"Function","signature_version":"v1"}],"vanir_signatures_modified":"2026-10-22T07:26:21Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H"}]}