CVE Intelligence
Analysis AI-assisted

CVE-2026-26240: QNAP File Station 5 Stack-based Buffer Overflow

QNAP disclosed a stack-based buffer overflow in File Station 5 that remote attackers may exploit to modify memory or crash processes. The vendor states the issue is fixed in File Station 5 version 5.5.6.5243 and later. The record shows no CISA KEV listing and no confirmed exploitation in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

QNAP has published an advisory for a stack-based buffer overflow (CWE-121) in File Station 5. According to the vendor, remote attackers may exploit it to modify memory or crash processes. The vendor's fixed release is described in the QNAP security advisory.

Impact

  • Possible modification of memory in the affected process.
  • Possible process crash, which may cause loss of availability.
  • NVD assigns a CVSS base score of 9.1 (critical). The scoring reflects high integrity and availability impact and no confidentiality impact.

Affected products and versions

  • The record lists two product entries: Qnap File Station from 5.5.6.4691 before 5.5.6.5243, and QNAP Systems Inc. File Station 5 from 5.5.0 before 5.5.6.5243.
  • The vendor fix is File Station 5 5.5.6.5243 and later.
  • The two entries overlap and use different product names; verify the installed version on your device.

Exploitation status

  • The record shows the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
  • No confirmed exploitation appears in the sources consulted.
  • SSVC exploitation is recorded as none, and automatable as yes. The EPSS probability is 0.00561 with a percentile of 0.45916.

Remediation and mitigation

  • Update File Station 5 to 5.5.6.5243 or later, as described by the vendor.
  • Inventory QNAP NAS devices that run File Station and record the installed version.
  • Limit network exposure of administrative and file services until the update is applied.

Detection guidance

  • Check the installed File Station version on each device against the fixed release.
  • Monitor for unexpected crashes or restarts of File Station processes.
  • Review logs for unusual or unexpected requests to File Station originating from untrusted networks.

Limitations of the available information

  • The record contains only the vendor description; no technical details of the overflow are provided.
  • The two affected-version entries use different product names and starting versions, and the exact overlap is not clarified.
  • Whether versions before 5.5.0 are affected is unknown.
  • The record's fixes list is empty; the fixed version is taken from the vendor description.

Frequently asked questions

What is CVE-2026-26240?

It is a stack-based buffer overflow in QNAP File Station 5 that, according to the vendor, remote attackers may exploit to modify memory or crash processes.

Which version fixes the issue?

The vendor states that File Station 5 version 5.5.6.5243 and later contain the fix.

Is this vulnerability known to be exploited?

The record shows it is not in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

What should administrators do?

Check the installed File Station version on each device, update to 5.5.6.5243 or later, and limit network exposure until the update is applied.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.