Out-of-Bounds Write Vulnerability in Qsync Central by QNAP
CVE-2025-30276

4.9MEDIUM

Key Information:

Vendor

QNAP
Status
Qsync Central
Vendor
CVE Published:
11 February 2026

What is CVE-2025-30276?

A vulnerability has been identified in Qsync Central that enables an attacker to execute an out-of-bounds write if they obtain a user account. This condition allows for memory modification or corruption, potentially leading to significant disruption and security risks. The vulnerability has been mitigated in version 5.0.0.4, released on January 20, 2026.

Affected Version(s)

Qsync Central 5.0.x.x < 5.0.0.4 ( 2026/01/20 )

References

https://www.qnap.com/en/security-advisory/qsa-26-02

CVSS V4

Score:
4.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

coral
.