NTPsec ntpd versions 1.1.4 through 1.2.5 accept NTS Authenticator and Encrypted Extension Fields (AEEF) that contain a nonce field. The parsing logic does not enforce a maximum size for this nonce, allowing an attacker to craft a packet with an oversized value. When a malformed packet is processed, the daemon attempts to read beyond the allocated buffer, causing an out‑of‑bounds read that ultimately crashes the daemon. The crash prevents the NTP service from responding to legitimate time queries, resulting in a denial of service to any client that relies on the server. A successful exploitation requires only the ability to send a crafted packet to the NTP server on the standard port, making the vulnerability remotely exploitable by any actor with network reach. The vulnerability is classified as a CWE‑125: Out‑of‑Bounds Read. In the affected versions, the crash does not lead to arbitrary code execution or data exfiltration; the primary consequence is loss of service availability for systems depending on the time source.

The NTPsec project provides the supplied ntpd daemon. Versions 1.1.4 up to and including 1.2.5 contain the flaw. The default installation of the ntpd binary and its configuration for NTS support are impacted. Upgrade to at least version 1.2.6, the first release that addresses the out‑of‑bounds read, resolves the issue.

The CVSS base score of 7.5 marks the flaw as a high‑severity vulnerability. The probability of exploitation is not quantified by an EPSS score, but the simple network‑based attack vector and low technical barrier suggest that exploitation is plausible in a hostile environment. The flaw is not yet listed in the CISA KEV catalog, so there are no publicly confirmed exploits as of the latest advisory. Still, once an attacker can reach the NTP port, they can easily craft the malicious packet to trigger a crash. The impact is limited to a service outage; however, in mission‑critical environments where accurate time is essential, such an outage can cascade into wider operational disruption.