CVE-2025-54166
An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions.
Published Jan 2, 2026 · updated Oct 14, 2026 · qnap quts hero
An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.1.3250 build 20250912 and later
Timeline
Detection, updates, and resolution for this record.
Jan 2, 2026 · NIST NVD
Detected
An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.1.3250 buil
Oct 14, 2026 · NIST NVD
Updated
An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.1.3250 buil
Affected
- cpe qnap/qts5.2.0.2737
- cpe qnap/quts heroh5.2.0.2737
- cpe qnap/quts heroh5.2.0.2782
- cpe qnap/quts heroh5.2.0.2789
- cpe qnap/quts heroh5.2.0.2802
- cpe qnap/quts heroh5.2.0.2823
- cpe qnap/quts heroh5.2.0.2851
- cpe qnap/quts heroh5.2.0.2860
- cpe qnap/quts heroh5.2.1.2929
Sources
- CVE.orgVulnerability recordCVE-2025-54166
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2025-54166
30-day exploitation probability 0.3%
first.org - NIST NVDVulnerability recordCVE-2025-54166
An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. We have already fixed the vulnerability in the following ve
nvd.nist.gov