CVE-2025-52864CWE-120

CVE-2025-52864

High · published January 2, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
28.0
In the wild
Unconfirmed
What it is

⚠️ A buffer overflow vulnerability can lead to chaos if a remote attacker gets a foothold! Think of it like an overflowing sink — if the water keeps spilling over, it can cause a mess and damage everything around it. In the tech world, this overflow can let attackers modify the memory of your system, much like how spilled water can ruin your favorite carpet. While this vulnerability is classified as low severity, its impact is still noteworthy! An attacker with a user account could potentially modify memory or cause processes to crash, leading to unexpected behavior or downtime.

Put simply

Think of it like an overflowing sink — if the water keeps spilling over, it can cause a mess and damage everything around it. In the tech world, this overflow can let attackers modify the memory of your system, much like how spilled water can ruin your favorite carpet. This buffer overflow vulnerability in certain QNAP operating systems allows remote attackers, who have gained user accounts, to overwrite memory, leading to unauthorized modifications and possible crashes of services.

What to do

While this vulnerability is classified as low severity, its impact is still noteworthy! An attacker with a user account could potentially modify memory or cause processes to crash, leading to unexpected behavior or downtime. To protect your systems, make sure to update to QTS 5.2.7.3256 build 20250913 or later, or QuTS hero h5.2.7.3256 build 20250913 or later. Check your version immediately and patch to ensure you're safe! You've got this! By updating your systems, you'll keep your data protected and your processes running smoothly. 🛡️

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00355 · 28.0th percentile
Weakness
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2026-01-02T20:16Z
Affected products (34)
ProductVersionsFixed in
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
References (1)
EPSS history
Timeline
  • 02 JAN 14:54Z
    QTS, QuTS hero
    cvelistv5