NULL Pointer Dereference in QNAP OS

CVE-2025-29882

What is CVE-2025-29882?

A NULL pointer dereference vulnerability has been identified in several versions of the QNAP operating system, potentially allowing remote attackers who possess a user account to exploit the flaw. This exploitation could lead to a denial-of-service (DoS) condition, disrupting service availability. Users are urged to upgrade to the fixed versions to mitigate this risk and ensure continued system integrity. The vulnerability impacts QTS 5.2.5.3145 build 20250526 and earlier, as well as QuTS hero h5.2.5.3138 build 20250519 and earlier.

References