CVE-2024-53695 is a critical severity (CVSS 9.1) buffer overflow in QNAP HBS 3 Hybrid Backup Sync. If exploited, remote attackers could modify memory or crash processes. QNAP says it is fixed in HBS 3 Hybrid Backup Sync 25.1.4.952 and later, so update the app from the App Center.
What's affected
The record names QNAP HBS 3 Hybrid Backup Sync as affected. QNAP states the fix is in HBS 3 Hybrid Backup Sync 25.1.4.952 and later. The advisory is QSA-25-06.
The record does not give the lower bound of the affected range, so treat any HBS 3 version below 25.1.4.952 as affected until the QNAP advisory says otherwise.
HBS 3 handles backup and sync jobs to and from NAS devices and cloud storage, so a flaw in it touches the data you rely on for recovery.
How to check if you're exposed
Open App Center on the NAS, find Hybrid Backup Sync, and read the version number. If it is lower than 25.1.4.952, update.
Then check which services on the NAS are reachable from outside your network, since the record describes remote attackers. Review the HBS job list for jobs or destinations you did not create.
What to do now
- Update HBS 3 Hybrid Backup Sync to 25.1.4.952 or later.
- Check that scheduled backup jobs still complete after the update.
- Keep the NAS off the public internet and use a VPN for remote access.
- Review HBS jobs and destinations for entries you do not recognise.
- Keep an offline or immutable copy of critical backups.
Why it matters
The record lists CWE-120 (Classic Buffer Overflow) and CWE-121 (Stack-based Buffer Overflow). These are memory errors where a program copies more data into a buffer on the stack than the buffer can hold. The result is that adjacent memory is overwritten, and the record says the effect could be modified memory or a crashed process.
Backup software is a good target because it holds credentials for storage and cloud accounts, and because a crash may silently stop protection. The score of 9.1 reflects network reach and high integrity and availability impact. The record does not flag exploitation, and the CVE is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-53695.
Quick check
Which version of HBS 3 fixes CVE-2024-53695?
QNAP says 25.1.4.952 and later.
Is this the same as the File Station issue?
No. That one is CVE-2024-48864, a separate flaw in a different QNAP app.
Sources
Last reviewed: 19 October 2026.
