This vulnerability (CWE-121) involves a buffer overflow in QNAP QTS that can be exploited by a remote attacker with administrator privileges to modify memory or cause process crashes. The issue affects QTS version 5.2.0 and earlier versions prior to the fixed releases. The vendor has released patches in QTS 5.2.9.3410 build 20260214 and later versions, including QuTS hero variants. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and privileges required at the high level.

An attacker with administrator access can exploit this buffer overflow to alter memory contents or crash system processes, potentially affecting system stability and security. The impact is limited by the prerequisite of having administrator privileges, reducing the risk of remote exploitation by unauthorized users.

The vulnerability is fixed in QTS 5.2.9.3410 build 20260214 and later versions, as well as in updated QuTS hero releases. Users should upgrade to these fixed versions to remediate the issue. Since this is not a cloud service, patching the affected systems is required. No additional mitigation guidance is provided by the vendor.