QNAP QTS and QuTS hero Out-of-Bounds Write Vulnerability Allowing Memory Corruption

An out-of-bounds write vulnerability has been identified in QNAP's QTS and QuTS hero operating systems, specifically in versions 5.2.x. This vulnerability allows remote attackers with administrator access to modify or corrupt memory. The issue has been resolved in QTS 5.2.3.3006 build 20250108 and later, as well as in QuTS hero h5.2.3.3006 build 20250108 and later.

Impact

Exploitation of this vulnerability could lead to unauthorized memory modification or corruption, potentially causing application instability or data loss.

Remediation

Users are advised to update to QTS 5.2.3.3006 build 20250108 or later, or to QuTS hero h5.2.3.3006 build 20250108 or later. Instructions for updating QTS or QuTS hero are available on the QNAP website.