The vulnerability is a stack‑based buffer overflow in QNAP's Media Streaming Add‑On that can be triggered by remote entities. When exploited, the flaw allows modification of memory or crash of the streaming process, leading to potential loss of service and device instability. The description does not confirm arbitrary code execution, but memory corruption could provide a foothold for further compromise if additional weaknesses exist.

The affected product is the Media Streaming Add‑On from QNAP Systems Inc. Versions earlier than 500.1.1 are vulnerable. The fixed release is 500.1.1 and later. Any device running a prior version of the add‑on is at risk.

The CVSS score of 2.7 categorizes this issue as low severity, and the EPSS score of less than 1% indicates a very low probability of exploitation. It is not listed in the CISA KEV catalog. Exploitation would require remote access to the add‑on, likely via network interfaces exposed by the device. Because the flaw can lead to memory corruption and crashes, it poses a risk of denial of service or, in a worst‑case scenario, sets the stage for further attacks if additional vulnerabilities exist.