Description
A buffer overflow vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes.

We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.5208 and later
Published: 2026-06-10
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An out-of-bounds write flaw exists in QNAP File Station 5 that can be triggered by a remote attacker with a valid user account. The flaw allows modification of memory or termination of the File Station process, as identified by CWE‑121. The description does not state that the vulnerability leads to arbitrary code execution.

Affected Systems

QNAP Systems Inc. File Station 5, all releases prior to version 5.5.6.5208. Versions 5.5.6.5208 and later contain the vendor-provided fix.

Risk and Exploitability

The CVSS score of 6.3 indicates a medium severity issue, but EPSS score of < 1% indicates a low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is authenticated remote, requiring a user account, and the exploitation would involve sending crafted traffic to trigger the buffer overflow.

Generated by OpenCVE AI on June 17, 2026 at 20:33 UTC.

Remediation

Vendor Solution

We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5208 and later

OpenCVE Recommended Actions

  • Upgrade File Station 5 to version 5.5.6.5208 or later
  • Restrict File Station access to trusted users and disable unnecessary remote services
  • Monitor system logs and network traffic for signs of abnormal memory usage or process crashes

Generated by OpenCVE AI on June 17, 2026 at 20:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 17 Jun 2026 05:15:00 +0000

Type Values Removed Values Added
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

 cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U'}

Fri, 12 Jun 2026 13:00:00 +0000

Type Values Removed Values Added
First Time appeared Qnap
Qnap file Station
CPEs cpe:2.3:a:qnap:file_station:*:*:*:*:*:*:*:*
Vendors & Products Qnap
Qnap file Station
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'}

Wed, 10 Jun 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 10 Jun 2026 04:45:00 +0000

Type Values Removed Values Added
First Time appeared Qnap Systems
Qnap Systems file Station 5
Vendors & Products Qnap Systems
Qnap Systems file Station 5

Wed, 10 Jun 2026 03:45:00 +0000

Type Values Removed Values Added
Description A buffer overflow vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5208 and later
Title File Station 5
Weaknesses CWE-121
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Qnap File Station
Qnap Systems File Station 5
cve-icon MITRE

Status: PUBLISHED

Assigner: qnap

Published:

Updated: 2026-06-17T01:47:04.260Z

Reserved: 2026-02-12T02:21:35.483Z

Link: CVE-2026-26239

cve-icon Vulnrichment

Updated: 2026-06-10T15:11:08.515Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-10T04:17:21.290

Modified: 2026-06-12T12:53:47.567

Link: CVE-2026-26239

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-17T20:45:03Z

Weaknesses
  • CWE-121

    Stack-based Buffer Overflow