An out-of-bounds read occurs within the Motorola Oncore refclock driver of NTPsec ntpd. An attacker who has control over the GPS receiver’s serial data can craft a PPS Control reply with an out‑of‑range mode byte, causing the driver to read memory beyond its intended bounds. This flaw may lead to disclosure of sensitive memory contents and can also trigger a crash of the ntpd daemon. The vulnerability is a CWE‑125 out‑of‑bounds read flaw.

All installations of NTPsec ntpd earlier than version 1.2.6 are affected. The vulnerability is tied specifically to the refclock driver for Motorola Oncore GPS hardware. Systems running the older NTPsec packages that rely on this driver need to be identified and upgraded.

The CVSS score of 5.2 indicates a moderate risk profile. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to have access to the GPS receiver’s serial port, either through physical proximity or via a network interface that allows manipulation of the serial data stream. Successful exploitation could cause ntpd to terminate unexpectedly or leak memory contents, potentially affecting service availability and confidentiality of stored data.