Quick answers
- Is CVE-2025-62858 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-62858 being exploited in the wild.
- How severe is CVE-2025-62858?
- Informational severity, with a CVSS score of 5.1, published 9 June 2026.
- Which products and versions are affected?
- QNAP Systems, Inc. QuTS hero h5.2.x prior to h5.2.9.3410 build 20260214; h5.3.x prior to h5.3.4.3500 build 20260520; h6.0.x prior to h6.0.0.3397 build 20260206.
- Is there a fix for CVE-2025-62858?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2025-62858 attacked?
- It is attacked over the network, in an operating system.
- Am I affected by CVE-2025-62858?
- Check whether you run QNAP Systems or Inc. QuTS hero at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A stack-based buffer overflow (CWE-121) exists in QNAP QTS and QuTS hero operating systems. The vulnerability is reachable over the network but requires high privileges (administrator account) to exploit. Successful exploitation allows an authenticated attacker to modify memory or cause a denial-of-service (DoS) by crashing system processes. QNAP has released patches for QTS 5.2.9, QuTS hero h5.2.9, h5.3.4, and h6.0.0 to address this issue.
Affected products
- QNAP Systems, Inc. QTS 5.2.x versions prior to 5.2.9.3410 build 20260214
- QNAP Systems, Inc. QuTS hero h5.2.x prior to h5.2.9.3410 build 20260214; h5.3.x prior to h5.3.4.3500 build 20260520; h6.0.x prior to h6.0.0.3397 build 20260206
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory