CVE-2025-52872CWE-120

CVE-2025-52872

High ยท published January 2, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
28.0
In the wild
Unconfirmed
What it is

โš ๏ธ A buffer overflow lurking in several QNAP operating systems could be your sneaky little gremlin! If a remote attacker manages to grab a user account, they could wreak havoc. ๐Ÿ”ฅ Think of this vulnerability as a crowded elevator. If someone pushes too many buttons, it can get stuck or malfunction โ€” that's how an attacker can mess with the memory or crash processes in your system! While this vulnerability is rated low on the severity scale, its consequences can be surprisingly sneaky. If exploited, attackers could modify memory and crash processes, potentially leading to unauthorized access and instability in your QNAP system. Not ideal!

Put simply

Think of this vulnerability as a crowded elevator. If someone pushes too many buttons, it can get stuck or malfunction โ€” that's how an attacker can mess with the memory or crash processes in your system! This buffer overflow vulnerability allows remote attackers with user accounts to manipulate memory or cause process crashes, fundamentally disrupting operation.

What to do

While this vulnerability is rated low on the severity scale, its consequences can be surprisingly sneaky. If exploited, attackers could modify memory and crash processes, potentially leading to unauthorized access and instability in your QNAP system. Not ideal! To safeguard your systems, update to QTS 5.2.7.3256 build 20250913 or later, QuTS hero h5.2.7.3256 build 20250913 or later, or QuTS hero h5.3.0.3192 build 20250716 or later. Keeping your systems updated is key! You've got this! Keeping your systems updated will ensure you're well protected! ๐Ÿ›ก๏ธ

The record
Technical detail
CVSS v3.1
8.1 ยท HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00355 ยท 28.0th percentile
Weakness
CWE-120 ยท Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2026-01-02T20:16Z
Affected products (34)
ProductVersionsFixed in
qnap/quts_heroall versionsโ€”
qnap/quts_heroall versionsโ€”
qnap/quts_heroall versionsโ€”
qnap/quts_heroall versionsโ€”
qnap/quts_heroall versionsโ€”
qnap/quts_heroall versionsโ€”
qnap/quts_heroall versionsโ€”
qnap/quts_heroall versionsโ€”
qnap/quts_heroall versionsโ€”
qnap/quts_heroall versionsโ€”
qnap/quts_heroall versionsโ€”
qnap/quts_heroall versionsโ€”
qnap/quts_heroall versionsโ€”
qnap/quts_heroall versionsโ€”
qnap/quts_heroall versionsโ€”
qnap/quts_heroall versionsโ€”
qnap/quts_heroall versionsโ€”
qnap/quts_heroall versionsโ€”
qnap/qtsall versionsโ€”
qnap/qtsall versionsโ€”
qnap/qtsall versionsโ€”
qnap/qtsall versionsโ€”
qnap/qtsall versionsโ€”
qnap/qtsall versionsโ€”
qnap/qtsall versionsโ€”
qnap/qtsall versionsโ€”
qnap/qtsall versionsโ€”
qnap/qtsall versionsโ€”
qnap/qtsall versionsโ€”
qnap/qtsall versionsโ€”
qnap/qtsall versionsโ€”
qnap/qtsall versionsโ€”
qnap/qtsall versionsโ€”
qnap/qtsall versionsโ€”
References (1)
EPSS history
Timeline
  • 02 JAN 14:54Z
    QTS, QuTS hero
    cvelistv5