This vulnerability (CVE-2025-66281) is a NULL pointer dereference (CWE-476) in QNAP QTS operating system versions, which can be triggered remotely without authentication to cause a denial-of-service (DoS) attack. The issue has been addressed by QNAP in specific builds of QTS and QuTS hero starting from versions 5.2.9.3410 and later. The CVSS 4.0 vector indicates the attack requires no privileges, no user interaction, and has low impact on availability but no impact on confidentiality or integrity.

Successful exploitation of this vulnerability allows remote attackers to cause a denial-of-service condition by triggering a NULL pointer dereference, potentially disrupting the availability of the affected QNAP device. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild at this time.

The vulnerability has been fixed by QNAP in QTS 5.2.9.3410 build 20260214 and later, QuTS hero h5.2.9.3410 build 20260214 and later, QuTS hero h5.3.4.3500 build 20260520 and later, and QuTS hero h6.0.0.3397 build 20260206 and later. Users should upgrade to these fixed versions or later to remediate the issue. Patch status is confirmed by the vendor advisory. No additional mitigations are specified.