CVE-2023-50364 is a Medium severity (CVSS 6.4) buffer copy without checking input size flaw in QNAP QTS and QuTS hero, mapped to a heap based overflow. Authenticated users could execute code over the network. Update to QTS 5.1.6.2722 build 20240402 or QuTS hero h5.1.6.2734 build 20240414 or later.
What's affected
Products: QNAP QTS and QuTS hero. Affected builds named in the record: QTS 5.1.0.2348 (build 20230325), 5.1.0.2399 (build 20230515), 5.1.0.2418 (build 20230603), and QuTS hero h5.1.0.2409 (build 20230525). Fixed: QTS 5.1.6.2722 build 20240402 and later, and QuTS hero h5.1.6.2734 build 20240414 and later, per QNAP advisory QSA-24-20. NVD published the record on 26 April 2024.
The QNAP advisory page is built with scripts and returned no readable text when I fetched it, so the affected and fixed builds below come from the NVD record, which quotes the advisory.
Severity: the record scores it 6.4 (Medium), with vector AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L. I only have the record's score, so I cannot compare it with a separate vendor rating. Note that the description says authenticated users could execute code, while the vector shows limited integrity or availability impact and no confidentiality impact, so the wording and the score do not line up perfectly. Treat the score as the formal rating and the description as a reminder not to ignore it.
The same advisory, QSA-24-20, covers several QTS and QuTS hero issues, including CVE-2023-50361, CVE-2023-50362 and CVE-2023-50363.
How to check if you're exposed
Check the QTS or QuTS hero firmware version in the web interface, under Control Panel, then System, then Firmware Update. The version and build date show on that page.
Compare it with the fixed builds: QTS 5.1.6.2722 build 20240402 or later, and QuTS hero h5.1.6.2734 build 20240414 or later. If your build is older, treat the NAS as affected. The record lists these older builds explicitly: QTS 5.1.0.2348 (build 20230325), 5.1.0.2399 (build 20230515), 5.1.0.2418 (build 20230603) and QuTS hero h5.1.0.2409 (build 20230525). The advisory may name more builds, so use the version comparison, not an exact match.
Then check whether the NAS web interface or any service on it is reachable from the internet. QNAP devices exposed to the internet are a frequent target in general, so reducing exposure is worth doing whatever the CVE says.
Like any appliance, a NAS does not show up in a dependency scan. Keep it in your asset inventory with its firmware build.
What to do now
- Update QTS to 5.1.6.2722 build 20240402 or later, or QuTS hero to h5.1.6.2734 build 20240414 or later, through Firmware Update in Control Panel.
- Take a backup or snapshot before you update, and read the release notes first.
- Remove the NAS from direct internet exposure. Use a VPN for remote access and turn off UPnP port forwarding.
- Review user accounts on the NAS and remove accounts that are unused, since the attacker needs to be logged in.
- Record the new firmware build in your inventory.
Why it matters
The weakness is CWE-120, buffer copy without checking the size of input, with the CWE-122 heap based overflow mapping. Where its siblings CVE-2023-50361 and CVE-2023-50362 are stack overflows, this one overflows memory on the heap. The cause is the same: data is copied without a check that it fits.
The heap versus stack difference changes how the flaw behaves, but not what you do about it. The record's vector adds an availability impact, so it scores slightly higher at 6.4. A heap overflow can corrupt other data the program holds, which can crash a service or change its behavior.
Authentication is required, so the risk depends on who holds accounts on the NAS. KEV is false and no source I read claims exploitation. Update the firmware, then close off internet access to the management interface. The free scan at gold.safeguard.sh/scan and the Gold directory cover the open source side of your estate.
Quick check
Why is this scored higher than the stack overflows?
The vector includes a limited availability impact in addition to limited integrity impact, which raises it from 5.0 to 6.4.
Can unauthenticated users reach it?
QNAP says authenticated users. The vector shows low privileges required.
Sources
Last reviewed: 19 October 2026.
