A classic buffer overflow occurs in the AdminCenter component of Synology BeeStation Manager (BSM) and BeeStation OS when data is copied into a buffer without proper size validation. The flaw allows an attacker to overwrite critical memory structures and execute arbitrary code, compromising the integrity and availability of the affected device.

Synology’s BeeStation Manager (BSM) and BeeStation OS are vulnerable in all releases dated before version 1.3.2‑65648. Users of older firmware are at risk until they upgrade beyond this build.

The potential impact is reflected in a CVSS base score of 9.8, indicating a very severe risk. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog. Because the description indicates that remote attackers can exploit the flaw via unspecified vectors, it is inferred that the attack is carried out over the network, likely through the AdminCenter management interface. The lack of an official workaround means that the safest mitigations rely on applying the vendor patch or cutting off external access.