# CVE-2025-66281: QNAP QTS and QuTS hero NULL pointer dereference

Source: https://junglewise.ai/threats/cve-2025-66281-qnap-qts-and-quts-hero-null-pointer-dereference  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2025-66281 · Severity: info · CVSS 6.9 · Published 2026-06-10

A vulnerability has been identified in QNAP operating systems used to manage Network Attached Storage (NAS) devices. A remote attacker could exploit this flaw to cause the system to crash or become unresponsive, leading to a denial-of-service. This impact prevents legitimate users from accessing stored data or using network services until the system is recovered.

Technologies: [QNAP Systems, Inc. QuTS hero](https://junglewise.ai/threats/technologies/quts-hero). Vendors: [QNAP Systems, Inc.](https://junglewise.ai/threats/vendors/qnap-systems-inc).

## Quick answers

**Is CVE-2025-66281 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-66281 being exploited in the wild.

**How severe is CVE-2025-66281?** Informational severity, with a CVSS score of 6.9, published 10 June 2026.

**Which products and versions are affected?** QNAP Systems, Inc. QuTS hero h5.2.x prior to h5.2.9.3410 build 20260214; h5.3.x prior to h5.3.4.3500 build 20260520; h6.0.x prior to h6.0.0.3397 build 20260206.

**Is there a fix for CVE-2025-66281?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-66281 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2025-66281?** Check whether you run QNAP Systems or Inc. QuTS hero at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A NULL pointer dereference (CWE-476) exists in several QNAP operating system versions, including QTS and QuTS hero. The vulnerability can be triggered by a remote attacker over the network without requiring authentication or user interaction. Successful exploitation leads to a denial-of-service (DoS) by causing the affected system component to crash. QNAP has released security updates for QTS 5.2.9, QuTS hero h5.2.9, h5.3.4, and h6.0.0 to address this issue.

## Affected products

- QNAP Systems, Inc. QTS 5.2.x versions prior to 5.2.9.3410 build 20260214
- QNAP Systems, Inc. QuTS hero h5.2.x prior to h5.2.9.3410 build 20260214; h5.3.x prior to h5.3.4.3500 build 20260520; h6.0.x prior to h6.0.0.3397 build 20260206

## Timeline

- 2026-06-10: disclosed
- 2026-06-10: advisory

## References

- [https://www.qnap.com/en/security-advisory/qsa-26-10](https://www.qnap.com/en/security-advisory/qsa-26-10)

## Related threats

- [QNAP QTS and QuTS hero command injection](https://junglewise.ai/threats/cve-2026-24719-qnap-qts-and-quts-hero-command-injection)
- [QNAP QTS and QuTS hero integer overflow in operating system](https://junglewise.ai/threats/cve-2025-66280-qnap-qts-and-quts-hero-integer-overflow-in-operating-system)
- [QNAP QTS and QuTS hero command injection](https://junglewise.ai/threats/cve-2025-66279-qnap-qts-and-quts-hero-command-injection)
- [QNAP QuTS hero NULL pointer dereference causing DoS](https://junglewise.ai/threats/cve-2025-62850-qnap-quts-hero-null-pointer-dereference-causing-dos)
- [QNAP QTS and QuTS hero buffer overflow](https://junglewise.ai/threats/cve-2025-62858-qnap-qts-and-quts-hero-buffer-overflow)