File Station 5 CVE-2026-26240

Exploitation requires passive user interaction - a legitimate File Station 5 user must open, preview, or otherwise interact with a crafted file or request delivered by the attacker (UI:P per CVSS 4.0); fully automated exploitation without any user involvement is not supported by the available data. The attacker must have network-level access to the File Station 5 service (AV:N), but no authentication or elevated privileges are required (PR:N). The vulnerability is specific to File Station 5 versions prior to 5.5.6.5243; systems running the patched release are not affected. Impact is scoped entirely to the vulnerable system - no lateral propagation to subsequent systems is indicated (SC:N/SI:N/SA:N). The passive user interaction requirement is the primary real-world limiting factor distinguishing this from a fully weaponizable unauthenticated network attack.

The CVSS 4.0 base score of 5.3 (Medium) reflects a constrained impact profile: confidentiality is entirely unaffected (VC:N), while integrity and availability on the vulnerable system are both rated Low (VI:L, VA:L), with zero impact to subsequent systems (SC:N/SI:N/SA:N). The network attack vector with low complexity and no privileges required (AV:N/AC:L/PR:N) would normally elevate concern, but the mandatory passive user interaction (UI:P) is a meaningful real-world friction point - fully automated, spray-and-pray exploitation is not supported by this vector. No EPSS score was provided, preventing probabilistic exploitation likelihood assessment. This CVE is not in the CISA KEV catalog, and no public exploit code has been identified from the available data. However, the CWE-121 stack-based overflow class carries inherent risk beyond what the CVSS impact scores capture: while the vendor describes memory modification and process crashes, stack overflows of this type can under certain conditions enable arbitrary code execution - this more severe outcome is not confirmed by available data but cannot be ruled out. Overall risk priority is moderate: patch promptly on internet-exposed NAS devices, but the user interaction requirement and absence of known exploits reduce urgency compared to a fully unauthenticated, zero-interaction network vulnerability.

An unauthenticated attacker reachable over the network uploads or delivers a crafted file to a QNAP NAS running File Station 5 prior to 5.5.6.5243, then entices or waits for a legitimate user to open or preview it through the File Station interface. The malformed input triggers a stack-based buffer overflow in the file-handling routine, corrupting stack memory and causing the File Station process to crash or behave unpredictably. No public exploit code has been identified, making targeted rather than opportunistic attacks the more plausible scenario at this time.