CVE-2025-11837 is a critical (9.8) improper control of code generation flaw in QNAP Malware Remover 6.6.x. Remote attackers can exploit it to bypass protection mechanisms. QNAP fixed it in Malware Remover 6.6.8.20251023 and later, so update the app through App Center on QTS or QuTS hero.
What's affected
QNAP advisory QSA-25-47 lists Malware Remover 6.6.x as affected, and Malware Remover 6.6.8.20251023 and later as fixed. The advisory cross references ZDI-CAN-28324.
The CVSS vector is AV:N/AC:L/PR:N/UI:N, rated high for confidentiality, integrity and availability. The advisory text gives little detail beyond improper control of code generation, and I describe nothing beyond it.
How to check if you're exposed
On the NAS, check the app version.
- Sign in to QTS or QuTS hero as an administrator.
- Open App Center and look for Malware Remover in the installed apps.
- If the version is older than 6.6.8.20251023, update it. QNAP says the Update button does not appear if the app is already current.
- Check whether the NAS web interface is exposed to the internet. Many NAS compromises start with remote access features left open.
What to do now
- Update Malware Remover from App Center to 6.6.8.20251023 or later, as QNAP recommends.
- Remove the app if you do not use it.
- Take management interfaces off the internet, and use a VPN for remote access.
- Review the NAS for unfamiliar user accounts, scheduled tasks and installed apps.
- Keep App Center auto update notifications on so future fixes reach you.
Why it matters
The weakness is CWE-94, improper control of generation of code. The application builds or accepts code in a way that lets outside input shape what runs. The advisory states the outcome as bypass of protection mechanisms and gives no further technical detail.
The irony is that the affected product is a security tool. Security software runs with high rights and touches many files, so a flaw in it is more valuable to an attacker than a flaw in a hobby app. Treat security add ons like any other software that needs patching.
Quick check
How do I update?
QNAP says to log in as administrator, open App Center, search for Malware Remover and click Update.
Sources
Last reviewed: 19 October 2026.
