CVE-2025-59383 is a buffer overflow in QNAP Media Streaming Add-On, scored CVSS 9.1 (critical). Remote attackers could modify memory or crash processes. QNAP fixed it in Media Streaming Add-on 500.1.1 and later, so update the add-on from the App Center.
What's affected
The record names QNAP Media Streaming Add-On. QNAP's advisory, listed as QSA-26-09, states the fix is in Media Streaming Add-on 500.1.1 and later, which means earlier builds are the ones to worry about. The weakness is tagged CWE-121, a stack based buffer overflow.
I could not load the QNAP page text, so the details here come from the NVD record, which quotes the vendor wording.
How to check if you're exposed
On a QNAP device, open the App Center and look at the installed version of Media Streaming Add-on. If it is below 500.1.1, it is in scope.
Also ask whether the add-on is needed. If nobody uses media streaming from the device, uninstalling it removes the attack surface entirely. Check which network ports the device exposes and whether any are reachable from the internet.
What to do now
- Open the App Center and update Media Streaming Add-on to 500.1.1 or later.
- If you do not use the add-on, stop and uninstall it.
- Keep the NAS off the public internet. Use a VPN for remote access.
- Read QNAP advisory QSA-26-09 for any further steps for your model.
- Check device logs for crashes of media services, which could be a sign of attempts.
Why it matters
The class is CWE-121, a stack based buffer overflow. The program copies more data into a fixed size area than it can hold and overwrites nearby memory. The record states the effects as modified memory or crashed processes.
The critical score reflects that the attack is remote. Network storage devices hold backups and shared files, and add-ons add code that runs with high rights. Updating or removing unused add-ons is a cheap way to reduce that risk. The KEV flag is false.
Quick check
Which version fixes it?
Media Streaming Add-on 500.1.1 and later, according to the QNAP wording in the NVD record.
Sources
Last reviewed: 19 October 2026.
