The vulnerability is a stack-based buffer overflow identified as CWE‑121. It allows a remote attacker who has already gained administrative privileges to corrupt memory or cause a process crash. The impact includes potential denial of service and loss of data integrity on the affected QNAP device.

The flaw affects QNAP Systems Inc. firmware products QTS and QuTS hero running older firmware versions. The specific fixed releases are QTS 5.2.9.3410 build 20260214 and later, QuTS hero h5.2.9.3410 build 20260214 and later, QuTS hero h5.3.4.3500 build 20260520 and later, and QuTS hero h6.0.0.3397 build 20260206 and newer.

The CVSS score of 5.1 places the flaw in the moderate severity range. The EPSS score is not available, so the exploitation frequency cannot be precisely quantified. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote network traffic that reaches an administrator interface; the attacker needs administrative privileges to trigger the overflow, after which memory corruption or a crash could occur. Because it requires privileged access, the risk is moderate but still significant for compromised systems.