CVE-2025-62852

MediumCVSS 6.5/10Last modified Oct 7, 2026

Description

A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes.

We have already fixed the vulnerability in the following version: QTS 5.2.8.3332 build 20251128 and later

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-121 CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Jan 2, 2026
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-628536.5A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit CVE-2025-628546.5An uncontrolled resource consumption vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, th CVE-2025-628554.4A path traversal vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator account, they can then CVE-2025-628564.4A path traversal vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator account, they can then CVE-2025-628576.1A cross-site scripting (XSS) vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to b CVE-2025-628586.5A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administra CVE-2025-62866.1A vulnerability classified as problematic has been found in PHPGurukul COVID19 Testing Management System 2021. Affected is an unknown functi CVE-2025-628624.6Ampere AmpereOne AC03 devices before 3.5.9.3, AmpereOne AC04 devices before 4.4.5.2, and AmpereOne M devices before 5.4.5.1 allow an incorre CVE-2025-628639.8Ampere AmpereOne AC03 devices before 3.5.9.3, AmpereOne AC04 devices before 4.4.5.2, and AmpereOne M devices before 5.4.5.1 allow an incorre CVE-2025-628649.8Ampere AmpereOne AC03 devices before 3.5.9.3, AmpereOne AC04 devices before 4.4.5.2, and AmpereOne M devices before 5.4.5.1 allow an incorre CVE-2025-628655.3Missing Authorization vulnerability in Evan Herman Post Cloner post-cloner allows Exploiting Incorrectly Configured Access Control Security CVE-2025-628664.3Cross-Site Request Forgery (CSRF) vulnerability in Valerio Monti Auto Alt Text auto-alt-text allows Cross Site Request Forgery.This issue af