CVE-2025-54164
An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions.
Published Jan 2, 2026 · updated Oct 14, 2026 · qnap quts hero
An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.1.3250 build 20250912 and later
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Jan 2, 2026 · NIST NVD
Detected
An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.1.3250 buil
Oct 14, 2026 · NIST NVD
Updated
An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.1.3250 buil
Affected
- cpe qnap/qts5.2.0.2737
- cpe qnap/quts heroh5.2.0.2737
- cpe qnap/quts heroh5.2.0.2782
- cpe qnap/quts heroh5.2.0.2789
- cpe qnap/quts heroh5.2.0.2802
- cpe qnap/quts heroh5.2.0.2823
- cpe qnap/quts heroh5.2.0.2851
- cpe qnap/quts heroh5.2.0.2860
- cpe qnap/quts heroh5.2.1.2929
Sources
- CVE.orgVulnerability recordCVE-2025-54164
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2025-54164
30-day exploitation probability 0.3%
first.org - NIST NVDVulnerability recordCVE-2025-54164
An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. We have already fixed the vulnerability in the following ve
nvd.nist.gov