A null pointer dereference can be triggered by a remote attacker who already has administrator credentials, leading to a denial-of-service that freezes the affected system. The flaw requires an authenticated session and impacts the availability of the QNAP operating system.

QNAP Systems Inc. QTS and QuTS hero devices are affected. All builds before QTS 5.2.9.3492 build 20260507, QuTS hero h5.2.9.3499 build 20260514, QuTS hero h5.3.4.3500 build 20260520, and QuTS hero h6.0.0.3459 build 20260409 are vulnerable.

The CVSS score of 5.1 indicates moderate severity. EPSS is unavailable, and the vulnerability is not listed in CISA KEV, suggesting no widespread exploitation yet, but it remains a valid risk. The attack path requires the attacker to obtain or compromise an administrator account; given that the attacker can then send a request that dereferences a null pointer, the impact is a denial of service. The official fix includes updated builds listed above; deploying them mitigates the threat.