Is there a patch available for CVE-2026-26240?

Yes, a patch is available for CVE-2026-26240. Update the affected software to the latest version immediately.

File Station 5 CVE-2026-26240

Q: What is the CVSS score of CVE-2026-26240?

CVE-2026-26240 has a CVSS 4.0 base score of 1.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-35983 LOW

Stack-based Buffer Overflow (CWE-121)

2026-06-10 security@qnapsecurity.com.tw

GHSA-872q-mhr9-36mh

Buffer Overflow Qnap Stack Overflow File Station

1.3

CVSS 4.0 · Vendor: qnapsecurity

Severity by source

Vendor (qnapsecurity) PRIMARY

1.3 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (qnapsecurity) · only source for this CVE.

CVSS VectorVendor: qnapsecurity

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Jul 23, 2026 - 09:22 NVD

MEDIUM LOW

CVSS changed

Jul 23, 2026 - 09:22 NVD

5.3 (MEDIUM) 1.3 (LOW)

Patch available

Jun 10, 2026 - 07:01 EUVD

Analysis Generated

Jun 10, 2026 - 05:32 vuln.today

DescriptionCVE.org

A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modify memory or crash processes.

We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later

AnalysisAI

Stack-based buffer overflow in QNAP File Station 5 allows unauthenticated remote attackers to corrupt process memory or crash the file management service when a victim user passively interacts with a crafted input. Affected versions are all File Station 5 releases prior to 5.5.6.5243, running on QNAP NAS devices accessible over the network. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog; QNAP has confirmed and released a fix in version 5.5.6.5243 via advisory QSA-26-32.

Technical ContextAI

File Station 5 is QNAP's web-based file management application deployed on NAS appliances, providing browser-accessible file browsing, upload, and management capabilities. CWE-121 classifies this as a stack-based buffer overflow - a condition where input data written to a stack-allocated buffer exceeds its declared bounds, overwriting adjacent stack memory regions such as saved return addresses or local variables, which can lead to control-flow hijacking or denial of service. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms the vulnerability is reachable over the network with low attack complexity, no special attack prerequisites, and no required privileges - though passive user interaction (UI:P) is necessary to trigger the overflow. Tags supplied by the reporter ('Buffer Overflow', 'Stack Overflow') corroborate the CWE-121 classification. No CPE strings were included in the source data; the affected product is identified solely by vendor name (QNAP) and product version range per advisory QSA-26-32.

RemediationAI

Upgrade QNAP File Station 5 to version 5.5.6.5243 or later - this is the vendor-confirmed fix per advisory QSA-26-32 at https://www.qnap.com/en/security-advisory/qsa-26-32. Until patching is feasible, restrict network exposure of the File Station 5 interface by placing the NAS behind a firewall or VPN and disabling direct internet-facing access, which directly mitigates the AV:N attack vector; note that this does not eliminate risk from attackers already present on the local network. Disabling the File Station 5 service entirely is an option with the trade-off of losing file management functionality. Because exploitation also requires passive user interaction (UI:P), instructing users to avoid opening files from untrusted sources via the File Station interface provides marginal additional risk reduction, but this is not a reliable compensating control and must not substitute for patching.