What’s Vulnerable › Vulnerabilities
CVE-2025-52863: QTS, QuTS hero
- Severity: high (CVSS 8.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-01-02 · updated 2026-10-14
- Weakness: CWE-120
Description
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.0.3192 build 20250716 and later
Affected products
- QNAP QTS: 5.2.0.2737-build_20240417, 5.2.0.2744-build_20240424, 5.2.0.2782-build_20240601, 5.2.0.2802-build_20240620, 5.2.0.2823-build_20240711, 5.2.0.2851-build_20240808 (+10)
- QNAP Systems Inc. QuTS hero: h5.2.0.2737-build_20240417, h5.2.0.2782-build_20240601, h5.2.0.2789-build_20240607, h5.2.0.2802-build_20240620, h5.2.0.2823-build_20240711, h5.2.0.2851-build_20240808 (+12)
References
Get alerted when CVE-2025-52863 or the next vulnerability affects your stack