Quick answers
- Is CVE-2025-29897 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-29897 being exploited in the wild.
- How severe is CVE-2025-29897?
- Informational severity, published 15 October 2026.
- Which products and versions are affected?
- QNAP Qsync Central before 5.0.0.4.
- Is there a fix for CVE-2025-29897?
- Yes: fixed in Qsync Central 5.0.0.4 and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-29897 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2025-29897?
- Check whether you run QNAP Qsync Central at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Qsync Central 5.0.0.4 and later
Technical details
A buffer copy without size validation exists in Qsync Central. An authenticated remote attacker can trigger the vulnerability by sending specially crafted input, leading to memory corruption that enables denial of service or potential code execution. The vulnerability requires prior account compromise or valid credentials.
Affected products
- QNAP Qsync Central before 5.0.0.4
Timeline
- 2026-10-15: disclosed