CVE-2025-12686CWE-120

CVE-2025-12686

Critical · published May 27, 2026

CVSS v3.1

9.8

EPSS

Percentile

86.2

In the wild

Unconfirmed

What it is

Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote attackers to execute arbitrary code via unspecified vectors.

The record

Technical detail

CVSS v3.1: 9.8 · CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.02762 · 86.2th percentile
Weakness: CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published: 2026-05-27T13:16Z

Affected products (1)

Product	Versions	Fixed in
synology/beestation_os	≥ 1.0, < 1.3.2	1.3.2

References (1)

https://www.synology.com/en-global/security/advisory/Synology_SA_25_12 · [email protected]

EPSS history

Timeline

27 MAY 08:37Z
Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote…
cvelistv5