A stack-based buffer overflow exists in QNAP Systems’ File Station 5. The flaw permits a remote attacker to send input that exceeds a memory buffer, potentially corrupting stack memory and allowing the attacker to alter memory contents or to cause the file handling processes to terminate unexpectedly. The vulnerability is classified as a CWE-121 weakness, and while the advisory does not explicitly confirm code execution, an attacker who controls the overflow payload could theoretically inject malicious code based on the nature of the overflow.

The flaw affects all QNAP File Station 5 installations running versions earlier than 5.5.6.5243. QNAP has released a fix in version 5.5.6.5243 and later. Any system that has not applied the update remains vulnerable, regardless of its network configuration or the operating system it runs on.

The CVSS score of 1.3 indicates low severity. The EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no widely known active exploits at this time. The description indicates the flaw can be triggered remotely through the File Station service, and it appears exploitable without special local privileges. While code execution is not explicitly documented, it is inferred that an attacker could achieve it by crafting a malicious overflow payload.