QNAP QTS and QuTS Hero Out-of-Bounds Read Vulnerability Allowing Data Exposure

An out-of-bounds read vulnerability has been identified in multiple versions of QNAP's operating systems, specifically QTS 5.2.x, QuTS hero h5.2.x, and QuTS hero h5.3.x. This vulnerability allows remote attackers with administrator access to exploit the issue and access confidential data.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information.

Remediation

Users can update to QTS 5.2.7.3256 build 20250913 or later, or QuTS hero h5.2.7.3256 build 20250913 and later. For QuTS hero h5.3.x, update to version h5.3.1.3250 build 20250912 or later.