# CVE-2025-62850: QNAP QuTS hero NULL pointer dereference causing DoS

Source: https://junglewise.ai/threats/cve-2025-62850-qnap-quts-hero-null-pointer-dereference-causing-dos  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2025-62850 · Severity: info · CVSS 5.1 · Published 2026-06-10

A vulnerability in QNAP's QuTS hero operating system, used in high-performance storage devices, could allow an attacker with administrative access to crash the system. By triggering a specific software error, the attacker can cause a denial-of-service, making the storage and its data temporarily unavailable to the organization. This requires the attacker to already possess high-level administrative credentials.

Technologies: [QNAP Systems, Inc. QuTS hero](https://junglewise.ai/threats/technologies/quts-hero). Vendors: [QNAP Systems, Inc.](https://junglewise.ai/threats/vendors/qnap-systems-inc).

## Quick answers

**Is CVE-2025-62850 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-62850 being exploited in the wild.

**How severe is CVE-2025-62850?** Informational severity, with a CVSS score of 5.1, published 10 June 2026.

**Which products and versions are affected?** QNAP Systems, Inc. QuTS hero h5.2.9.3410 build 20260214, h5.3.4.3500 build 20260520, h6.0.0.3459 build 20260409.

**Is there a fix for CVE-2025-62850?** A patch was published on 2026-02-14: Fix released for QuTS hero h5.2.9.3410 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-62850 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2025-62850?** Check whether you run QNAP Systems or Inc. QuTS hero at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A NULL pointer dereference (CWE-476) exists in several versions of QNAP's QuTS hero operating system. The vulnerability is reachable over the network but requires high privileges (administrative account). An attacker with these credentials can exploit the flaw to cause a system crash or service instability, resulting in a denial-of-service (DoS) condition. QNAP has released patches for the QuTS hero h5.2, h5.3, and h6.0 branches to address this issue.

## Affected products

- QNAP Systems, Inc. QuTS hero h5.2.9.3410 build 20260214, h5.3.4.3500 build 20260520, h6.0.0.3459 build 20260409

## Timeline

- 2026-06-10: advisory: Initial advisory published by QNAP and NVD
- 2026-02-14: patched: Fix released for QuTS hero h5.2.9.3410
- 2026-05-20: patched: Fix released for QuTS hero h5.3.4.3500
- 2026-04-09: patched: Fix released for QuTS hero h6.0.0.3459

## References

- [https://www.qnap.com/en/security-advisory/qsa-26-38](https://www.qnap.com/en/security-advisory/qsa-26-38)

## Related threats

- [QNAP QTS and QuTS hero command injection](https://junglewise.ai/threats/cve-2026-24719-qnap-qts-and-quts-hero-command-injection)
- [QNAP QTS and QuTS hero NULL pointer dereference](https://junglewise.ai/threats/cve-2025-66281-qnap-qts-and-quts-hero-null-pointer-dereference)
- [QNAP QTS and QuTS hero integer overflow in operating system](https://junglewise.ai/threats/cve-2025-66280-qnap-qts-and-quts-hero-integer-overflow-in-operating-system)
- [QNAP QTS and QuTS hero command injection](https://junglewise.ai/threats/cve-2025-66279-qnap-qts-and-quts-hero-command-injection)
- [QNAP QTS and QuTS hero buffer overflow](https://junglewise.ai/threats/cve-2025-62858-qnap-qts-and-quts-hero-buffer-overflow)