QNAP QTS and QuTS hero Double Free Vulnerability Allowing Memory Modification

A double free vulnerability has been identified in QNAP QTS versions 5.2.x and QuTS hero h5.2.x. This vulnerability allows remote attackers with administrator access to modify memory, potentially leading to further exploitation.

Impact

Exploitation of this vulnerability could allow for unauthorized memory modification, which may be leveraged for arbitrary code execution or to cause memory corruption.

Remediation

Users can update to QTS 5.2.3.3006 build 20250108 or later, and QuTS hero h5.2.3.3006 build 20250108 or later. Instructions for updating QTS or QuTS hero are available on the QNAP website.