Synology DiskStation Manager: Denial-of-service via nfsd (CVE-2026-18633)
An access of uninitialized pointer vulnerability in the nfsd component of Synology DiskStation Manager (DSM) allows remote attackers to conduct denial-of-service attacks.
CVE search metadata
CVE search record: CVE-2026-18633. Severity: high. CVSS: 7.5. KEV: no. Product: DiskStation Manager (< 7.3.2-86009-5, < 7.4.1-90080-1). Brief: Synology DiskStation Manager: Denial-of-service via nfsd (CVE-2026-18633). Brief link: https://feed.craftedsignal.io/briefs/2026-11-synology-dsm-nfsd-dos-cve-2026-18633/
Triage facts
Revision 1- Applicability
- DiskStation Manager (< 7.3.2-86009-5, < 7.4.1-90080-1)
- Evidence
- Unknown
- Severity
- Low
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 09:30 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Synology DiskStation Manager (DSM) contains an access of uninitialized pointer vulnerability in the nfsd component. This vulnerability, identified as CVE-2026-18633, can be exploited by a remote attacker to cause a denial-of-service (DoS) condition on the affected device. The vulnerability has a CVSS v3.1 base score of 7.5.
Impact
Successful exploitation allows a remote attacker to disrupt system availability by triggering a denial-of-service condition via the nfsd service.
Recommendation
Review vendor security advisories for updates addressing CVE-2026-18633.
Threat Hunt
Identify abnormal termination or frequent restarts of the nfsd process on Synology DSM devices, which may indicate exploitation attempts causing service crashes.
Data: Process monitoring logs, System service management logs, Application crash logs