CVE-2023-52946 is a high severity (8.2) classic buffer overflow in the vss service of Synology Drive Client before 3.5.0-16084. Remote attackers can overwrite buffers and crash the client. Synology fixed it and says there is no mitigation, so upgrade to 3.5.0-16084 or later.
What's affected
Synology advisory Synology-SA-24:10, published on 26 September 2024, lists Synology Drive Client as affected, rated Important, with the fix "Upgrade to 3.5.0-16084 or above". The mitigation field reads None.
The advisory describes the flaw as buffer copy without checking size of input in the vss service component, which lets a remote attacker overwrite trivial buffers and crash the client through unspecified vectors. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H, and the record agrees with the advisory.
Weakness class: CWE-120.
The same advisory covers five other CVEs from 2022 that were fixed in earlier client builds: 3.3.0-15082 and 3.4.0-15721. Moving to 3.5.0-16084 or later covers all of them.
How to check if you're exposed
Check the version in the client itself. Open Synology Drive Client, go to the main menu, and read the About information. Anything older than 3.5.0-16084 is affected.
For fleets, query installed software through your endpoint management tool, for example by listing installed programs named Synology Drive Client and reading the version.
Include laptops that are rarely online, since they often lag. Check the Synology download center for the current client build.
What to do now
- Upgrade Synology Drive Client on every machine to 3.5.0-16084 or later.
- Use your software distribution tool to push the installer, and verify the version afterwards.
- Do not look for a workaround. The advisory says there is none.
- Read Synology-SA-24:10 for the other listed issues and confirm they are covered by the same upgrade.
Why it matters
A classic buffer overflow means data is copied into a buffer without checking that it fits. The Synology advisory says the result here is overwriting trivial buffers and crashing the client, and it gives no more detail about the vectors. I will not guess beyond it.
Sync clients run on laptops that move between networks and often stay out of date for months. A crash of the client is an availability problem for the user, and the advisory also gives an integrity impact of Low in the vector, so it should not be treated as a pure nuisance. Because the vectors are unspecified, the safest planning assumption is that any reachable client is in scope until it is upgraded. The CVE is not in the CISA Known Exploited Vulnerabilities catalog per the record.
Quick check
Is there a workaround?
No. The Synology advisory lists the mitigation as None and gives an upgrade as the fix.
Which version is fixed?
Synology Drive Client 3.5.0-16084 or above.
Sources
Last reviewed: 19 October 2026.
