CVE-2026-26241 is a critical stack based buffer overflow (CVSS 9.1) in QNAP File Station 5, published alongside CVE-2026-26240 with the same description. Remote attackers can modify memory or crash processes. The fix is File Station 5 version 5.5.6.5243 or later.
What's affected
The record says File Station 5 is affected and that QNAP fixed the issue in File Station 5 5.5.6.5243 and later. Any earlier File Station 5 build should be treated as vulnerable.
QNAP covers this CVE and CVE-2026-26240 in one advisory, QSA-26-10, with identical wording and the same fixed version.
How to check if you're exposed
Open App Center on the QNAP device, find File Station 5 and read the version. Anything below 5.5.6.5243 needs the update.
Then check how the NAS is exposed. If its web interface answers from the internet, fix that first.
What to do now
- Update File Station 5 to 5.5.6.5243 or later in App Center.
- Check the version again after the update.
- Close any port forwarding to the NAS and use a VPN for remote file access.
- Read advisory QSA-26-10 for model specific notes.
Why it matters
The class is CWE-121, a stack based buffer overflow: input larger than the buffer overwrites nearby stack memory. QNAP describes the result as modified memory or crashed processes. The vector shows network access, low complexity, no login and no user action, with high impact on integrity and availability.
The record is not in the CISA Known Exploited Vulnerabilities catalog. You do not need to work out which of the two you would hit. Patch once and both are covered.
Quick check
Is CVE-2026-26241 the same as CVE-2026-26240?
The descriptions match, but they are separate CVE records in the same QNAP advisory. One update to 5.5.6.5243 or later covers both.
Sources
- QNAP security advisory QSA-26-10 (cited by the record; fixed version taken from the NVD record text)
- NVD record for CVE-2026-26241
Last reviewed: 19 October 2026.
