CVE-2025-12686

Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation Manager (BSM) before 1.3.2-65648 and Synology BeeStation OS before 1.3.2-65648 allows remote attackers to execute arbitrary code via unspecified vectors.

Scoring

Severity

CRITICAL

CVSS base score

9.8

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS probability

2.76%

CWE

CWE-120

Published

2026-05-27

Last modified

2026-05-27

Affected products

• Synology BeeStation Manager (BSM)
• Synology BeeStation Manager (BSM)
• Synology BeeStation Manager (BSM)
• Synology BeeStation Manager (BSM)
• Synology BeeStation OS
• Synology BeeStation OS
• Synology BeeStation OS
• Synology BeeStation OS

Weakness type

• CWE-120

Related vulnerabilities

• CVE-2026-82542 — Tenda HG10 Boa Web Server formIPv6Routing buffer overflow
• CVE-2026-44756 — Memory Corruption vulnerability in SAP Extended Passport (EPP) Processing
• CVE-2026-17040 — Vulnerabilities in IBM AIX and PowerVM VIOS
• CVE-2026-55209 — resdata insufficiently validates untrusted GRDECL files
• CVE-2026-90608 — Totolink A3002MU boa formPortFw buffer overflow
• CVE-2026-90606 — Totolink A3002MU boa formIpv6Setup buffer overflow
• CVE-2026-90605 — Totolink A3002MU boa formFilter buffer overflow
• CVE-2026-87931 — Behavioral Technology Group Pavlok Behavioral Conditioning Wearable Apple Notification Center Service Event buffer overflow

Markdown version · Browse all CVEs