CVE-2025-62858 is a buffer overflow vulnerability (CWE-121) affecting QNAP QTS operating system versions. The vulnerability allows a remote attacker who already has administrator access to exploit the flaw to modify memory or crash processes, potentially disrupting system stability or behavior. The vulnerability is addressed in specific fixed versions of QTS and QuTS hero, with patches released in builds from early 2026. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and requires high privileges, with limited impact on confidentiality and availability.

An attacker with administrator privileges on affected QNAP QTS systems can exploit this buffer overflow to modify memory or crash processes, which may lead to system instability or denial of service. The vulnerability does not allow privilege escalation or remote code execution without prior administrative access. The CVSS score of 5.1 reflects a medium severity impact.

The vulnerability has been fixed in QTS 5.2.9.3410 build 20260214 and later, QuTS hero h5.2.9.3410 build 20260214 and later, QuTS hero h5.3.4.3500 build 20260520 and later, and QuTS hero h6.0.0.3397 build 20260206 and later. Users should upgrade to these or later versions to remediate the vulnerability. No additional mitigation steps are indicated.