Critical 9.8Published May 27, 2026

CVE-2025-12686Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote attackers to execute arbitrary code via…

Updated under an hour ago (Oct 26, 2026, 4:40 PM ET)

Does this affect you?

It affects Synology BeeStation OS. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Synology BeeStation OS

Exploited in the last 30 days

Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote attackers to execute arbitrary code via unspecified vectors.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-120
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: synology
NVD analysis: Analyzed
Record last updated: May 27, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Synology BeeStation OS synology:beestation_os (from the name)	from 1.3 before 1.3.2-65648; from 1.2 before 1.3.2-65648; from 1.1 before 1.3.2-65648; from 1.0 before 1.3.2-65648; before 1.0 status unknown	CNA record
synology beestation_os synology:beestation_os	from 1.0 before 1.3.2	NVD

References

References

https://www.synology.com/en-global/security/advisory/Synology_SA_25_12	vendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.