QNAP File Station 5 EUVD-2026-35981

The vulnerability requires no authentication (PR:N) and no special server-side configuration - File Station 5 in its default installed state is vulnerable. The sole limiting condition is passive user interaction (UI:P in CVSS 4.0), which in CVSS 4.0 terminology means a user must be engaged in a normal session or workflow (e.g., a session must be active or a user must open a file/URL as part of routine use), rather than requiring the attacker to socially engineer a specific click. This is a weak constraint in a NAS context where File Station sessions are frequently long-lived. Exploitation is limited to network-reachable instances; NAS devices not exposed to untrusted networks or firewalled from the internet have materially reduced risk. There is no indication of a non-default configuration requirement - the vulnerable code path appears to be in standard File Station 5 functionality.

The CVSS 4.0 base score of 5.3 (Medium) reflects a constrained impact profile: only low integrity impact to the vulnerable system (VI:L) and no confidentiality or availability impact scored. This conflicts with the vendor description, which explicitly states attackers can 'crash processes' - a capability that would typically register as at least some availability impact (VA:L). This discrepancy should be verified against the vendor advisory at QSA-26-27; the scored impact may underrepresent real-world effect. The attack vector is network (AV:N), complexity is low (AC:L), and no privileges are required (PR:N), making the vulnerability broadly reachable. Passive user interaction (UI:P in CVSS 4.0) indicates a user need only be present in a normal session context - not that they must click a malicious link - which is a relatively weak limiting condition. No EPSS data was provided; given the absence of KEV listing and no known public exploit, opportunistic mass exploitation is not confirmed but cannot be ruled out given the unauthenticated network attack surface. The CVSS Exploit Maturity field (E:X) is 'Not Defined', meaning no exploit maturity signal is embedded in the score. Overall: elevated real-world risk relative to the Medium CVSS score due to the unauthenticated network vector and process-crash capability, tempered by no confirmed exploitation.

A remote unauthenticated attacker identifies a QNAP NAS with File Station 5 exposed to the network, then sends a crafted HTTP request containing an oversized input field to a File Station endpoint that performs insufficient bounds-checking into a stack buffer. The overflow corrupts adjacent stack memory, allowing the attacker to crash the File Station process or - depending on the specific overflow and binary protections in place - potentially redirect execution. No public exploit code has been identified at time of analysis, so successful code execution beyond process crash remains unconfirmed.