CVE-2026-24721: Null Pointer Dereference in File Station 5
Published Oct 15, 2026
·Updated
A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later
Affected Software
1 affected component
QNAP File Station 5<5.5.6.5243
Event History
Oct 15, 2026
CVE Published
via MITRE·06:59 AM
Data Sourced
via MITRE·06:59 AM
RemedyDescriptionWeakness
Frequently Asked Questions
1
Who is exposed to this vulnerability?
QNAP File Station 5 deployments running versions earlier than 5.5.6.5243 are affected. Exploitation requires a remote attacker to first obtain a user account.
2
What is the impact of successful exploitation?
An authenticated remote attacker can trigger a denial-of-service condition through a NULL pointer dereference. The provided information does not describe impacts beyond service disruption.
3
What version fixes the issue?
The issue is fixed in File Station 5 version 5.5.6.5243 and later.