CVE-2025-54152
A use of out-of-range pointer offset vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read sensitive portions of memory. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
Scoring
- Severity
- LOW
- CVSS base score
- 1.3
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
- EPSS probability
- 0.37%
- CWE
- CWE-823
- Published
- 2026-02-11
- Last modified
- 2026-03-12
Affected products
- QNAP Systems Inc. Qsync Central
Weakness type
Related vulnerabilities
- CVE-2026-31912 — OOBR in libpcap before 1.10.7
- CVE-2026-45199 — GPU DDK - rgxfw_to_ptr() does not reject FW private data pointers
- CVE-2026-72642 — Use of Out-of-range Pointer Offset in the Elasticsearch Machine Learning Native Inference Process
- CVE-2026-49746 — GPU DDK - Dimension Mismatch and Integer Truncation in PMRDevPhysAddrOSMem
- CVE-2026-49745 — GPU DDK - Unvalidated sHWPerfCtlDMABuf GPU-VA, DMA-write into FW privdata via MMU ctx 0
- CVE-2026-49744 — GPU DDK - Unchecked ui32TracePointer in rgxfw_log_ex()
- CVE-2026-21734 — GPU DDK - libusc OOB write at TreeRemove during WebGPU shader compilation
- CVE-2026-34193 — GPU DDK - Arbitrary write via UFO updates due insufficient pointer validation in rgxfw_to_ptr()