# CVE-2025-66274: QNAP QTS and QuTS hero NULL pointer dereference

Source: https://junglewise.ai/threats/cve-2025-66274-qnap-qts-and-quts-hero-null-pointer-dereference  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-11. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2025-66274 · Severity: medium · CVSS 4.9 · Published 2026-02-11

A vulnerability in QNAP's network-attached storage (NAS) operating systems could allow an attacker with administrative access to crash the system. By triggering a specific software error, the attacker can cause a denial-of-service, making the storage device and its data temporarily unavailable to the business. This issue affects several versions of the QTS and QuTS hero operating systems.

Technologies: [QNAP QTS](https://junglewise.ai/threats/technologies/qts). Vendors: [QNAP](https://junglewise.ai/threats/vendors/qnap).

## Quick answers

**Is CVE-2025-66274 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-66274 being exploited in the wild.

**How severe is CVE-2025-66274?** Medium severity, with a CVSS score of 4.9, published 11 February 2026.

**Which products and versions are affected?** QNAP QTS 5.2.9.3410 build 20260214 and later.

**Is there a fix for CVE-2025-66274?** A patch was published on 2025-12-25: Fix released for QuTS hero h5.3.x Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-66274 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2025-66274?** Check whether you run QNAP QTS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A NULL pointer dereference vulnerability (CWE-476) exists in several QNAP operating system versions, including QTS and QuTS hero. The flaw is reachable over the network but requires high privileges, specifically an administrator account. By exploiting this vulnerability, an authenticated attacker can cause a system crash or process termination, resulting in a denial-of-service (DoS) condition. QNAP has released security updates to address this issue across the affected product lines.

## Affected products

- QNAP QTS 5.2.9.3410 build 20260214 and later
- QNAP QuTS hero h5.2.9.3410 build 20260214 and later; h5.3.2.3354 build 20251225 and later; h6.0.0.3397 build 20260206 and later

## Timeline

- 2026-02-11: advisory: Initial NVD publication date
- 2026-02-12: advisory: QNAP security advisory QSA-26-08 published
- 2025-12-25: patched: Fix released for QuTS hero h5.3.x

## References

- [https://www.qnap.com/en/security-advisory/qsa-26-08](https://www.qnap.com/en/security-advisory/qsa-26-08)

## Related threats

- [QNAP QTS and QuTS hero path traversal](https://junglewise.ai/threats/cve-2026-24717-qnap-qts-and-quts-hero-path-traversal)
- [QNAP QTS and QuTS hero NULL pointer dereference DoS](https://junglewise.ai/threats/cve-2026-24716-qnap-qts-and-quts-hero-null-pointer-dereference-dos)
- [QNAP QTS and QuTS hero command injection](https://junglewise.ai/threats/cve-2026-22893-qnap-qts-and-quts-hero-command-injection)
- [QNAP QTS and QuTS hero command injection](https://junglewise.ai/threats/cve-2025-66273-qnap-qts-and-quts-hero-command-injection)
- [QNAP QTS and QuTS web parameter manipulation](https://junglewise.ai/threats/cve-2025-59382-qnap-qts-and-quts-web-parameter-manipulation)