CVE-2025-29897
LowCVSS 2.3Summary
A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes.
Risk Assessment
An authenticated remote attacker can corrupt memory or crash services, potentially causing availability loss or further exploitation.
Recommendation
Update Qsync Central to version 5.0.0.4 or later, which contains the fix for this vulnerability.
Other vulnerabilities in Qsync Central
See all- CVE-2026-41541Medium
An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. The vulnerability has been fixed in versions 5.0.0.7, 5.1.0.3, 5.2.0.5, and 5.3.0.2 and later.
- CVE-2026-26243High
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
- CVE-2026-24718Medium
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
- CVE-2025-29896Low
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
- CVE-2025-29895Low
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
Original NVD description (English source)
A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later
Vulnerability data from NVD (NIST) · CISA KEV · EPSS