The vulnerability is an allocation of resources without limits or throttling in QNAP File Station 5. After a remote attacker obtains a user account, they can trigger the flaw to tie up resources, preventing other systems, applications or processes from accessing the same resource type. The flaw leads to a denial‑of‑service condition that can disrupt file service availability and may affect other nearby services that depend on the same underlying system resources.

This weakness appears in QNAP Systems Inc.'s File Station 5. The official fix covers version 5.5.6.5243 and later, so any installations prior to that version may be vulnerable. Specific impacted build numbers are not listed beyond the indicated patch release.

The CVSS score is 5.3, which is a medium severity rating. No EPSS score is available, so the current exploit probability cannot be quantified from public data. The vulnerability is not listed in the CISA KEV catalog. The attack is likely to be remote, requiring the attacker to have a compromised user account. Once authenticated, the attacker can trigger the flaw, causing resource exhaustion and a denial of service.