TI-2025-36945 Aliases CVE-2025-59386 GHSA-xmr6-mm5f-8mf2

NULL pointer dereference in QNAP QuTS hero

LOW 14CWE-476Published 2026-02-11 · Updated 2026-02-27

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-476.

Summary

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: QuTS hero h5.3.2.3354 build 20251225 and later

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00439 38th percentileScored 2026-11-07

Fix Fixed QuTS hero (QNAP Systems Inc.): h5.3.2.3354 build 20251225

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
QNAP	QuTS hero	h5.3.x to before h5.3.2.3354 build 20251225	h5.3.2.3354 build 20251225	Patch available	CNA

QuTS hero VendorQNAP Affected h5.3.x to before h5.3.2.3354 build 20251225 Fixed in h5.3.2.3354 build 20251225 Patch available CNA

CPE configurations NVD · 5

CPE	Versions	Role	Vendor
cpe:2.3:o:qnap:quts_hero:h5.3.0.3115:build_20250430::::::	h5.3.0.3115 build_20250430	Vulnerable	QNAP
cpe:2.3:o:qnap:quts_hero:h5.3.0.3145:build_20250530::::::	h5.3.0.3145 build_20250530	Vulnerable	QNAP
cpe:2.3:o:qnap:quts_hero:h5.3.0.3192:build_20250716::::::	h5.3.0.3192 build_20250716	Vulnerable	QNAP
cpe:2.3:o:qnap:quts_hero:h5.3.1.3250:build_20250912::::::	h5.3.1.3250 build_20250912	Vulnerable	QNAP
cpe:2.3:o:qnap:quts_hero:h5.3.1.3292:build_20251024::::::	h5.3.1.3292 build_20251024	Vulnerable	QNAP

cpe:2.3:o:qnap:quts_hero:h5.3.0.3115:build_20250430:*:*:*:*:*:* Versions h5.3.0.3115 build_20250430 Vulnerable ·QNAP
cpe:2.3:o:qnap:quts_hero:h5.3.0.3145:build_20250530:*:*:*:*:*:* Versions h5.3.0.3145 build_20250530 Vulnerable ·QNAP
cpe:2.3:o:qnap:quts_hero:h5.3.0.3192:build_20250716:*:*:*:*:*:* Versions h5.3.0.3192 build_20250716 Vulnerable ·QNAP
cpe:2.3:o:qnap:quts_hero:h5.3.1.3250:build_20250912:*:*:*:*:*:* Versions h5.3.1.3250 build_20250912 Vulnerable ·QNAP
cpe:2.3:o:qnap:quts_hero:h5.3.1.3292:build_20251024:*:*:*:*:*:* Versions h5.3.1.3292 build_20251024 Vulnerable ·QNAP

Remediation

Fix · CNA QuTS hero (QNAP Systems Inc.) Fixed in h5.3.2.3354 build 20251225

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-02-11
QNAP Systems QuTS hero h5.3.2.3354 build 20251225
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-30947 Buffer overflow in QNAP QuTS heroPriority LOW 6
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2025-59386
2026-10-03 Alias added: GHSA-xmr6-mm5f-8mf2

References

Advisory 1

https://www.qnap.com/en/security-advisory/qsa-26-08

TI-2020-02221 Command Injection Vulnerability in QTS and QuTS hero KEVCVSS 3.1CRITICAL 9.8
TI-2023-25536 Command injection in QNAP QTS CVSS 3.1HIGH 8.3
TI-2024-35889 Link following in QNAP QTS CVSS 4.0HIGH 8.7
TI-2024-17986 Buffer overflow in QNAP QTS CVSS 3.1HIGH 8.8
TI-2024-14559 Improper authentication in QNAP QTS CVSS 3.1CRITICAL 9.8
TI-2023-09214 OS command injection in QNAP QTS CVSS 3.1CRITICAL 9.8

See all 233 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences