Main Vulnerability Database Vulnerabilities #VU134937

Stack-based buffer overflow in QNAP Systems, Inc. products - CVE-2025-66280

Published: June 19, 2026

Vulnerability identifier: #VU134937

CSH Severity: Low

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-66280

CWE-ID: CWE-121

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote administrator can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

QuTScloud
QuTS hero
QVP (QVR Pro appliances)
QNAP QTS

How to mitigate CVE-2025-66280

Install updates from vendor's website.

QuTScloud - update to
QuTScloud - update to c5.2.9
QuTS hero - update to h5.2.9
QVP (QVR Pro appliances) - update to 2.8.0
QNAP QTS - update to 5.2.10

External References

https://www.qnap.com/en/security-advisory/qsa-26-10

Related Security Bulletins