QNAP QTS and QuTS hero Out-of-Bounds Read Vulnerability Allowing Data Exposure

A vulnerability allowing out-of-bounds read has been identified in multiple QNAP operating system versions, including QTS 5.2.x and QuTS hero h5.2.x and h5.3.x. This vulnerability can be exploited by remote attackers who gain access to an administrator account, allowing them to read beyond the intended memory boundaries and potentially access secret data.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive data.

Remediation

Users can update to QTS 5.2.7.3256 build 20250913 or later, or QuTS hero h5.2.7.3256 build 20250913 and later. For QuTS hero h5.3.x, update to QuTS hero h5.3.1.3250 build 20250912 and later.