CVE-2025-48721: QTS, QuTS hero

Q: What is the severity of CVE-2025-48721?

CVE-2025-48721 has been classified as a high severity buffer overflow vulnerability.

Q: How do I fix CVE-2025-48721?

To fix CVE-2025-48721, update your QNAP operating system to version 5.2.8.3333 or later.

Q: Which QNAP products are affected by CVE-2025-48721?

CVE-2025-48721 affects several versions of QNAP QTS and QuTS hero up to version 5.2.8.3332.

Q: Can CVE-2025-48721 be exploited remotely?

Yes, CVE-2025-48721 can be exploited remotely if an attacker gains access to an administrator account.

Q: What can an attacker achieve by exploiting CVE-2025-48721?

An attacker exploiting CVE-2025-48721 can modify memory or crash processes on the affected systems.

Published Jan 2, 2026

Updated

A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes.

We have already fixed the vulnerability in the following version: QTS 5.2.8.3332 build 20251128 and later

Affected Software

40 affected components

QNAP QTS<5.2.8.3332

QNAP QuTS hero<5.2.8.3332

QNAP QTS=5.2.0.2737-build_20240417

QNAP QTS=5.2.0.2744-build_20240424

QNAP QTS=5.2.0.2782-build_20240601

QNAP QTS=5.2.0.2802-build_20240620

QNAP QTS=5.2.0.2823-build_20240711

QNAP QTS=5.2.0.2851-build_20240808

QNAP QTS=5.2.0.2860-build_20240817

QNAP QTS=5.2.1.2930-build_20241025

QNAP QTS=5.2.2.2950-build_20241114

QNAP QTS=5.2.3.3006-build_20250108

QNAP QTS=5.2.4.3070-build_20250312

QNAP QTS=5.2.4.3079-build_20250321

QNAP QTS=5.2.4.3092-build_20250403

QNAP QTS=5.2.5.3145-build_20250526

QNAP QTS=5.2.6.3195-build_20250715

QNAP QTS=5.2.6.3229-build_20250818

QNAP QTS=5.2.7.3256-build_20250913

QNAP QTS=5.2.7.3297-build_20251024

QNAP QuTS hero=h5.2.0.2737-build_20240417

QNAP QuTS hero=h5.2.0.2782-build_20240601

QNAP QuTS hero=h5.2.0.2789-build_20240607

QNAP QuTS hero=h5.2.0.2802-build_20240620

QNAP QuTS hero=h5.2.0.2823-build_20240711

QNAP QuTS hero=h5.2.0.2851-build_20240808

QNAP QuTS hero=h5.2.0.2860-build_20240817

QNAP QuTS hero=h5.2.1.2929-build_20241025

QNAP QuTS hero=h5.2.1.2940-build_20241105

QNAP QuTS hero=h5.2.2.2952-build_20241116

QNAP QuTS hero=h5.2.3.3006-build_20250108

QNAP QuTS hero=h5.2.4.3070-build_20250312

QNAP QuTS hero=h5.2.4.3079-build_20250321

QNAP QuTS hero=h5.2.5.3138-build_20250519

QNAP QuTS hero=h5.2.6.3195-build_20250715

QNAP QuTS hero=h5.2.7.3256-build_20250913

QNAP QuTS hero=h5.2.7.3297-build_20251024

QNAP QuTS hero=h5.3.0.3115-build_20250430

QNAP QuTS hero=h5.3.0.3145-build_20250530

QNAP QuTS hero=h5.3.0.3192-build_20250716

Remediation

Information

We have already fixed the vulnerability in the following version: QTS 5.2.8.3332 build 20251128 and later

Event History

Jan 2, 2026

CVE Published

via MITRE·03:17 PM

Data Sourced

via MITRE·03:17 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-48721?

CVE-2025-48721 has been classified as a high severity buffer overflow vulnerability.

How do I fix CVE-2025-48721?