Is there a patch available for CVE-2026-26241?

Yes, a patch is available for CVE-2026-26241. Update the affected software to the latest version immediately.

QNAP File Station 5 CVE-2026-26241

Q: What is the CVSS score of CVE-2026-26241?

CVE-2026-26241 has a CVSS 4.0 base score of 1.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-35981 LOW

Stack-based Buffer Overflow (CWE-121)

2026-06-10 security@qnapsecurity.com.tw

GHSA-v3m3-m62c-qrgr

Buffer Overflow Qnap Stack Overflow File Station

1.3

CVSS 4.0 · Vendor: qnapsecurity

Severity by source

Vendor (qnapsecurity) PRIMARY

1.3 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (qnapsecurity) · only source for this CVE.

CVSS VectorVendor: qnapsecurity

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Jul 23, 2026 - 09:22 NVD

MEDIUM LOW

CVSS changed

Jul 23, 2026 - 09:22 NVD

5.3 (MEDIUM) 1.3 (LOW)

Patch available

Jun 10, 2026 - 07:01 EUVD

Analysis Generated

Jun 10, 2026 - 05:32 vuln.today

DescriptionCVE.org

A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modify memory or crash processes.

We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later

AnalysisAI

Stack-based buffer overflow in QNAP File Station 5 enables remote unauthenticated attackers to corrupt memory or destabilize processes through a network-accessible attack path requiring only passive user interaction. Affected versions are all releases prior to 5.5.6.5243; QNAP's own security team (security@qnapsecurity.com.tw) discovered and disclosed the issue via advisory QSA-26-27. No public exploit code exists and the vulnerability is not listed in CISA KEV; however, the unauthenticated network attack vector lowers the bar for opportunistic targeting of QNAP NAS deployments.

Technical ContextAI

CWE-121 (Stack-based Buffer Overflow) identifies the root cause: attacker-controlled input is written into a fixed-size stack buffer without adequate bounds checking, allowing overwrite of adjacent stack memory including saved return addresses or frame pointers. This class of vulnerability in a web-facing file management application (QNAP File Station 5) is particularly concerning because File Station is a browser-accessible NAS service exposed to the network. The CVSS 4.0 vector confirms the network attack surface (AV:N), no required attack prerequisites beyond the product itself (AT:N), and no authentication requirement (PR:N), meaning the vulnerable parsing or handling routine is reachable before any login. The 'Stack Overflow' tag corroborates CWE-121, indicating the overflow occurs on the stack frame rather than the heap.

RemediationAI

Vendor-released patch: File Station 5 version 5.5.6.5243 and later, per QNAP advisory QSA-26-27 (https://www.qnap.com/en/security-advisory/qsa-26-27). Users should upgrade through the QNAP App Center or via manual package installation immediately. If immediate patching is not feasible, the most actionable compensating controls are: restrict access to the File Station 5 web interface by binding it to a management VLAN or requiring VPN access before reaching the service, which eliminates the AV:N attack surface without disabling the application; alternatively, disable File Station 5 entirely in the QNAP App Center if the service is not required, eliminating all exposure. Blocking external internet-facing access to the QNAP NAS management ports (typically TCP 8080, 443, 8443) at the network perimeter reduces opportunistic attack surface without affecting internal users. Note: restricting network access does not remediate the underlying stack overflow and should be treated as a bridge measure only.