A NULL pointer dereference vulnerability was identified in QNAP File Station 5, allowing a remote user who already has account credentials to trigger a denial‑of‑service attack. The flaw occurs when the application fails to validate a null pointer before dereferencing, causing the service to crash. Successful exploitation results in service interruption, impacting availability of the file share for all connected clients. No data loss or unauthorized access is observed from the provided information.

The vulnerability affects QNAP Systems Inc.’s File Station 5 component. All releases before version 5.5.6.5208 are potentially impacted. Users running any earlier version should verify their installed build and plan to update accordingly.

With a CVSS score of 5.3, the vulnerability is categorized as moderate. The EPSS score is unavailable, and the issue is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation. An attacker would need remote access to a legitimate user account, after which they can trigger the crash by interacting with the vulnerable service. Because the flaw requires authentication, the threat surface is reduced compared to fully unauthenticated vulnerabilities, but the impact to service availability could still disrupt business operations.