A heap-based buffer overflow exists in the JJY refclock driver of NTPsec ntpd prior to version 1.2.6. The flaw allows an attacker who controls the Telephone JJY time source to send more than six time replies, causing memory corruption or a crash of the ntpd process. This vulnerability is classified as CWE‑122, indicating improper bounds checking in heap memory management.

The affected product is NTPsec ntpd, as published by the vendor NTPsec:ntpsec. All installations running any version before 1.2.6 are potentially susceptible; no further granularity of affected sub‑versions is supplied by the CNA.

The CVSS score of 6.4 reflects a moderate severity without a confirmed exploitation vector. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploit activity. The likely attack path is over the network, relying on the attacker’s ability to control the Telephone JJY source. Successful exploitation could lead to memory corruption or denial of service for the ntpd daemon, potentially disrupting time synchronization services and impacting applications that depend on accurate system time.