A buffer overflow flaw exists in QNAP File Station 5 that allows attackers to corrupt application memory or cause a crash. The resulting modification of memory could lead to elevation of privileges, arbitrary code execution, or denial‑of‑service. The weakness is identified as CWE‑121, a classic buffer overflow scenario affecting confidentiality, integrity, and availability if exploited.

The vulnerability affects QNAP Systems Inc.’s File Station 5, specifically versions prior to 5.5.6.5243. Any device running a lower version is susceptible. No other products are listed as impacted.

The CVSS score of 5.3 indicates moderate severity, and no EPSS data is available, so the likelihood of exploitation is uncertain. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not been widely observed in the wild. The exploit appears to be remote; no local privileges are required. Attackers would need network access to the File Station interface to trigger the buffer overflow.