CVE-2025-59386CWE-476

QuTS hero

Low · published February 11, 2026

CVSS v4.0

1.2

EPSS

Percentile

36.1

In the wild

Unconfirmed

What it is

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:

QuTS hero h5.3.2.3354 build 20251225 and later

The record

Technical detail

CVSS v4.0: 1.2 · LOW
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
EPSS: 0.00429 · 36.1th percentile
Weakness: CWE-476 · NULL Pointer Dereference
Published: 2026-02-11T12:16Z

EPSS history

Timeline

11 FEB 12:16Z
QuTS hero
cvelistv5