CVE-2025-59386
MEDIUMQNAP QuTS hero - Denial of Service via NULL Pointer Dereference
Title source: llmDescription
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: QuTS hero h5.3.2.3354 build 20251225 and later
References (1)
Core 1
Core References
Vendor Advisory
https://www.qnap.com/en/security-advisory/qsa-26-08
Scores
CVSS v3
4.9
EPSS
0.0037
EPSS Percentile
28.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-476
Status
published
Products (5)
qnap/quts_hero
h5.3.0.3115 build_20250430
qnap/quts_hero
h5.3.0.3145 build_20250530
qnap/quts_hero
h5.3.0.3192 build_20250716
qnap/quts_hero
h5.3.1.3250 build_20250912
qnap/quts_hero
h5.3.1.3292 build_20251024
Published
Feb 11, 2026
Tracked Since
Feb 18, 2026