CVE-2023-26552
mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point.
CVE-2023-26552 is a medium vulnerability (CVSS 5.6) in Ntp, published April 11, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.64%, the 50th percentile. Fixed in ntp 4.2.8p14-7.oe1.
mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
NVD Score used
mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.
- Record
CVE-2023-26552- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List
mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.
- Record
CVE-2023-26552- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2023-30349
mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.
- Record
EUVD-2023-30349- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-55jm-6fgm-6r95
mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point.
mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point.
- Record
GHSA-55jm-6fgm-6r95- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.
- Record
CVE-2023-26552- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-26552
mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.
- Record
DEBIAN-CVE-2023-26552- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
Show 4 moreShow less
OSVOESA-2023-1282
ntp security update
NTP is a protocol designed to synchronize the clocks of computers over a network, NTP version 4, a significant revision of the previous NTP standard, is the current development version. It is formalized by RFCs released by the IETF.
Security Fix(es):
mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.(CVE-2023-26551)
mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.(CVE-2023-26554)
mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.(CVE-2023-26553)
mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.(CVE-2023-26552)
- Record
OESA-2023-1282- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-26552
mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.
- Record
UBUNTU-CVE-2023-26552- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVSUSE-SU-2023:2142-1 No score
Security update for ntp
This update for ntp fixes the following issues:
Fixed multiple out of bound writes: CVE-2023-26551 (bsc#1210386), CVE-2023-26552 (bsc#1210388), CVE-2023-26553 (bsc#1210387), CVE-2023-26554 (bsc#1210389).
- Record
SUSE-SU-2023:2142-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:2171-1 No score
Security update for ntp
This update for ntp fixes the following issues:
Fixed multiple out of bound writes:
CVE-2023-26551 (bsc#1210386), CVE-2023-26552 (bsc#1210388), CVE-2023-26553 (bsc#1210387), CVE-2023-26554 (bsc#1210389).
- Record
SUSE-SU-2023:2171-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ntpDebian:11 |
All versions, plus listed versions 1:4.2.8p15+dfsg-11:4.2.8p15+dfsg-2-hurd.11:4.2.8p15+dfsg-2~1.2.1+dfsg1-7+hurd.11:4.2.8p15+dfsg-2~1.2.1+dfsg1-8+hurd.11:4.2.8p15+dfsg-2~1.2.2+dfsg1-2+hurd.11:4.2.8p15+dfsg-2~hurd.1 |
None known |
ntpopenEuler:20.03-LTS-SP1 |
before 4.2.8p14-7.oe1 | 4.2.8p14-7.oe1 |
ntpopenEuler:20.03-LTS-SP3 |
before 4.2.8p14-7.oe1 | 4.2.8p14-7.oe1 |
ntpopenEuler:22.03-LTS |
before 4.2.8p15-9.oe2203sp1 | 4.2.8p15-9.oe2203sp1 |
ntpopenEuler:22.03-LTS-SP1 |
before 4.2.8p15-9.oe2203sp1 | 4.2.8p15-9.oe2203sp1 |
ntpSUSE:Linux Enterprise Module for Legacy 15 SP4 |
before 4.2.8p15-150000.4.22.1 | 4.2.8p15-150000.4.22.1 |
ntpopenSUSE:Leap 15.4 |
before 4.2.8p15-150000.4.22.1 | 4.2.8p15-150000.4.22.1 |
ntpSUSE:Linux Enterprise Server 12 SP5 |
before 4.2.8p15-100.1 | 4.2.8p15-100.1 |
ntpSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 4.2.8p15-100.1 | 4.2.8p15-100.1 |
ntpUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1:4.2.6.p5+dfsg-3ubuntu21:4.2.6.p5+dfsg-3ubuntu2.14.04.11:4.2.6.p5+dfsg-3ubuntu2.14.04.21:4.2.6.p5+dfsg-3ubuntu2.14.04.31:4.2.6.p5+dfsg-3ubuntu2.14.04.5 Show 8 moreShow less1:4.2.6.p5+dfsg-3ubuntu2.14.04.61:4.2.6.p5+dfsg-3ubuntu2.14.04.71:4.2.6.p5+dfsg-3ubuntu2.14.04.81:4.2.6.p5+dfsg-3ubuntu2.14.04.101:4.2.6.p5+dfsg-3ubuntu2.14.04.111:4.2.6.p5+dfsg-3ubuntu2.14.04.121:4.2.6.p5+dfsg-3ubuntu2.14.04.131:4.2.6.p5+dfsg-3ubuntu2.14.04.13+esm1 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ntpUbuntu:16.04:LTS |
All versions, plus listed versions 1:4.2.6.p5+dfsg-3ubuntu81:4.2.6.p5+dfsg-3ubuntu8.11:4.2.6.p5+dfsg-3ubuntu91:4.2.8p4+dfsg-3ubuntu11:4.2.8p4+dfsg-3ubuntu2 Show 13 moreShow less1:4.2.8p4+dfsg-3ubuntu31:4.2.8p4+dfsg-3ubuntu41:4.2.8p4+dfsg-3ubuntu51:4.2.8p4+dfsg-3ubuntu5.11:4.2.8p4+dfsg-3ubuntu5.21:4.2.8p4+dfsg-3ubuntu5.31:4.2.8p4+dfsg-3ubuntu5.41:4.2.8p4+dfsg-3ubuntu5.51:4.2.8p4+dfsg-3ubuntu5.61:4.2.8p4+dfsg-3ubuntu5.71:4.2.8p4+dfsg-3ubuntu5.81:4.2.8p4+dfsg-3ubuntu5.91:4.2.8p4+dfsg-3ubuntu5.10 |
None known |
ntpUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1:4.2.8p10+dfsg-5ubuntu31:4.2.8p10+dfsg-5ubuntu41:4.2.8p10+dfsg-5ubuntu51:4.2.8p10+dfsg-5ubuntu61:4.2.8p10+dfsg-5ubuntu7 Show 7 moreShow less1:4.2.8p10+dfsg-5ubuntu7.11:4.2.8p10+dfsg-5ubuntu7.1+esm11:4.2.8p10+dfsg-5ubuntu7.1+esm21:4.2.8p10+dfsg-5ubuntu7.21:4.2.8p10+dfsg-5ubuntu7.2+esm11:4.2.8p10+dfsg-5ubuntu7.31:4.2.8p10+dfsg-5ubuntu7.3+esm1 |
None known |
ntpUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1:4.2.8p12+dfsg-3ubuntu21:4.2.8p12+dfsg-3ubuntu31:4.2.8p12+dfsg-3ubuntu41:4.2.8p12+dfsg-3ubuntu4.20.04.11:4.2.8p12+dfsg-3ubuntu4.20.04.1+esm1 |
None known |
ntpUbuntu:22.04:LTS |
All versions, plus listed versions 1:4.2.8p12+dfsg-3ubuntu61:4.2.8p15+dfsg-1ubuntu11:4.2.8p15+dfsg-1ubuntu2 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
github.com/spwpun/ntp-4.2.8p15-cves/blob/main/CVE-2023-26552
nvd.nist.gov/vuln/detail/CVE-2023-26552
security-tracker.debian.org/tracker/CVE-2023-26552
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1282
Show 15 moreShow less
suse.com/support/update/announcement/2023/suse-su-20232142-1
bugzilla.suse.com/1210386
ubuntu.com/security/CVE-2023-26552
cve.org/CVERecord?id=CVE-2023-26552