CVE-2023-26554

mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character.

5.6 MediumFix available

mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

0.64%Up 0.6 points since Apr 12, 2023

What each source reports

NVD Score used 5.6

mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.

Record: CVE-2023-26554
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-787
Updated: 2026-11-02

CVE List 5.6

mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.

Record: CVE-2023-26554
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-787
Updated: 2026-11-02

EUVDEUVD-2023-30351 5.6

mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.

Record: EUVD-2023-30351
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-03

GitHub AdvisoriesGHSA-p43r-r5fw-2w5x 5.6

mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character.

mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character.

Record: GHSA-p43r-r5fw-2w5x
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-787
Updated: 2026-11-02

OSV 5.6

mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.

Record: CVE-2023-26554
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-02

OSVDEBIAN-CVE-2023-26554 5.6

mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.

Record: DEBIAN-CVE-2023-26554
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-02

Show 4 moreShow less

OSVOESA-2023-1282 5.6

ntp security update

NTP is a protocol designed to synchronize the clocks of computers over a network, NTP version 4, a significant revision of the previous NTP standard, is the current development version. It is formalized by RFCs released by the IETF.

Security Fix(es):

mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.(CVE-2023-26551)

mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.(CVE-2023-26554)

mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.(CVE-2023-26553)

mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.(CVE-2023-26552)

Record: OESA-2023-1282
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-26554 5.6

mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.

Record: UBUNTU-CVE-2023-26554
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-02

OSVSUSE-SU-2023:2142-1 No score

Security update for ntp

This update for ntp fixes the following issues:

Fixed multiple out of bound writes: CVE-2023-26551 (bsc#1210386), CVE-2023-26552 (bsc#1210388), CVE-2023-26553 (bsc#1210387), CVE-2023-26554 (bsc#1210389).

Record: SUSE-SU-2023:2142-1
Updated: 2026-11-02

OSVSUSE-SU-2023:2171-1 No score

Security update for ntp

This update for ntp fixes the following issues:

Fixed multiple out of bound writes:

CVE-2023-26551 (bsc#1210386), CVE-2023-26552 (bsc#1210388), CVE-2023-26553 (bsc#1210387), CVE-2023-26554 (bsc#1210389).

Record: SUSE-SU-2023:2171-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`ntp` Debian:11	All versions, plus listed versions 1:4.2.8p15+dfsg-11:4.2.8p15+dfsg-2-hurd.11:4.2.8p15+dfsg-2~1.2.1+dfsg1-7+hurd.11:4.2.8p15+dfsg-2~1.2.1+dfsg1-8+hurd.11:4.2.8p15+dfsg-2~1.2.2+dfsg1-2+hurd.11:4.2.8p15+dfsg-2~hurd.1	None known
`ntp` openEuler:20.03-LTS-SP1	before 4.2.8p14-7.oe1	4.2.8p14-7.oe1
`ntp` openEuler:20.03-LTS-SP3	before 4.2.8p14-7.oe1	4.2.8p14-7.oe1
`ntp` openEuler:22.03-LTS	before 4.2.8p15-9.oe2203sp1	4.2.8p15-9.oe2203sp1
`ntp` openEuler:22.03-LTS-SP1	before 4.2.8p15-9.oe2203sp1	4.2.8p15-9.oe2203sp1
`ntp` SUSE:Linux Enterprise Module for Legacy 15 SP4	before 4.2.8p15-150000.4.22.1	4.2.8p15-150000.4.22.1
`ntp` openSUSE:Leap 15.4	before 4.2.8p15-150000.4.22.1	4.2.8p15-150000.4.22.1
`ntp` SUSE:Linux Enterprise Server 12 SP5	before 4.2.8p15-100.1	4.2.8p15-100.1
`ntp` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	before 4.2.8p15-100.1	4.2.8p15-100.1
`ntp` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 1:4.2.6.p5+dfsg-3ubuntu21:4.2.6.p5+dfsg-3ubuntu2.14.04.11:4.2.6.p5+dfsg-3ubuntu2.14.04.21:4.2.6.p5+dfsg-3ubuntu2.14.04.31:4.2.6.p5+dfsg-3ubuntu2.14.04.5 Show 8 moreShow less 1:4.2.6.p5+dfsg-3ubuntu2.14.04.61:4.2.6.p5+dfsg-3ubuntu2.14.04.71:4.2.6.p5+dfsg-3ubuntu2.14.04.81:4.2.6.p5+dfsg-3ubuntu2.14.04.101:4.2.6.p5+dfsg-3ubuntu2.14.04.111:4.2.6.p5+dfsg-3ubuntu2.14.04.121:4.2.6.p5+dfsg-3ubuntu2.14.04.131:4.2.6.p5+dfsg-3ubuntu2.14.04.13+esm1	None known

Show 4 moreShow less

Affected packages
Package	Affected	Fixed
`ntp` Ubuntu:16.04:LTS	All versions, plus listed versions 1:4.2.6.p5+dfsg-3ubuntu81:4.2.6.p5+dfsg-3ubuntu8.11:4.2.6.p5+dfsg-3ubuntu91:4.2.8p4+dfsg-3ubuntu11:4.2.8p4+dfsg-3ubuntu2 Show 13 moreShow less 1:4.2.8p4+dfsg-3ubuntu31:4.2.8p4+dfsg-3ubuntu41:4.2.8p4+dfsg-3ubuntu51:4.2.8p4+dfsg-3ubuntu5.11:4.2.8p4+dfsg-3ubuntu5.21:4.2.8p4+dfsg-3ubuntu5.31:4.2.8p4+dfsg-3ubuntu5.41:4.2.8p4+dfsg-3ubuntu5.51:4.2.8p4+dfsg-3ubuntu5.61:4.2.8p4+dfsg-3ubuntu5.71:4.2.8p4+dfsg-3ubuntu5.81:4.2.8p4+dfsg-3ubuntu5.91:4.2.8p4+dfsg-3ubuntu5.10	None known
`ntp` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 1:4.2.8p10+dfsg-5ubuntu31:4.2.8p10+dfsg-5ubuntu41:4.2.8p10+dfsg-5ubuntu51:4.2.8p10+dfsg-5ubuntu61:4.2.8p10+dfsg-5ubuntu7 Show 7 moreShow less 1:4.2.8p10+dfsg-5ubuntu7.11:4.2.8p10+dfsg-5ubuntu7.1+esm11:4.2.8p10+dfsg-5ubuntu7.1+esm21:4.2.8p10+dfsg-5ubuntu7.21:4.2.8p10+dfsg-5ubuntu7.2+esm11:4.2.8p10+dfsg-5ubuntu7.31:4.2.8p10+dfsg-5ubuntu7.3+esm1	None known
`ntp` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 1:4.2.8p12+dfsg-3ubuntu21:4.2.8p12+dfsg-3ubuntu31:4.2.8p12+dfsg-3ubuntu41:4.2.8p12+dfsg-3ubuntu4.20.04.11:4.2.8p12+dfsg-3ubuntu4.20.04.1+esm1	None known
`ntp` Ubuntu:22.04:LTS	All versions, plus listed versions 1:4.2.8p12+dfsg-3ubuntu61:4.2.8p15+dfsg-1ubuntu11:4.2.8p15+dfsg-1ubuntu2	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-26554 is a medium vulnerability (CVSS 5.6) in Ntp, published April 11, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.64%, the 50th percentile. Fixed in ntp 4.2.8p14-7.oe1.

References

Show 15 moreShow less