Media Streaming Add On EUVD-2025-208893

Without a published CVSS score or EPSS probability data, risk assessment relies on structural analysis: the attack vector is network-based (remote), the vulnerability requires no authentication (unauthenticated remote attack surface), and the impact includes memory corruption and process denial of service. The CWE-121 classification (stack overflow) indicates potential for arbitrary code execution if the overflow can overwrite return addresses, though the current advisory only mentions memory modification and crashes. The availability of a patch (version 500.1.1 and later) demonstrates vendor responsiveness. This is a legitimate priority requiring patching; stack-based buffer overflows in network-facing services represent high real-world risk regardless of missing CVSS metrics.

An attacker on the same network or with remote access to a QNAP NAS could send a specially crafted network request or media file to the Media Streaming Add-On service, causing a stack buffer overflow. This could immediately crash the streaming service (denial of service) or, depending on payload construction, corrupt adjacent stack memory to achieve code execution. No public proof-of-concept is referenced, but the straightforward nature of network-accessible media processing makes exploitation feasible once the vulnerability details are disclosed.