Vulnerability record · CVE-2025-42599 · published 18 April 2025
CVE-2025-42599: Qualitia Active! mail stack buffer overflow allows remote code execution
Qualitia · Active\! Mail
Active! mail 6 (BuildInfo 6.60.05008561 and earlier) contains a stack-based buffer overflow (CWE-121). A remote unauthenticated attacker can trigger it with a specially crafted request, leading to arbitrary code execution or denial of service. It is a critical, network-reachable flaw in a mail product and is listed in CISA KEV.
Description
Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a specially crafted request created and sent by a remote unauthenticated attacker may lead to arbitrary code execution and/or a denial-of-service (DoS) condition.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with network, unauthenticated, no-interaction exploitation and confirmed inclusion in CISA KEV make this an urgent patch.
What it is
Active! mail 6 (BuildInfo 6.60.05008561 and earlier) contains a stack-based buffer overflow (CWE-121). A remote unauthenticated attacker can trigger it with a specially crafted request, leading to arbitrary code execution or denial of service. It is a critical, network-reachable flaw in a mail product and is listed in CISA KEV.
Impact
An attacker can execute arbitrary code on the mail server or crash it, gaining control of the host or disrupting mail service.
Attack surface
Reachable over the network via a crafted request to the Active! mail service; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required.
Exploitation
CISA added it to KEV on 2025-04-28 with a 2025-05-19 remediation due, indicating known exploitation; EPSS 30-day probability is 0.03298 (87.9th percentile). No ransomware use is documented.
What to do
- Apply the vendor fix from Qualitia for Active! mail 6; upgrade beyond BuildInfo 6.60.05008561 per the vendor advisory.
- If no patch is available, follow CISA KEV required action: apply vendor mitigations or discontinue use of the product.
- Restrict network access to the Active! mail service to trusted sources and place it behind filtering where feasible.
- Monitor vendor and JVN advisories for updated fixed builds and interim mitigations.
Detection
- Inspect Active! mail service logs for malformed or oversized requests and crashes/restarts around the same time.
- Monitor for unexpected process crashes or abnormal child processes spawned by the mail service.
- Alert on network traffic to the Active! mail service from untrusted or unexpected source addresses.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2025-42599 to the Known Exploited Vulnerabilities catalog on 28 April 2025 as "Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability". Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 19 May 2025.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://jvn.jp/en/jp/JVN22348866/ | Third Party Advisory |
| https://www.qualitia.com/jp/news/2025/04/18_1030.html | Vendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-42599 | US Government Resource |
Track CVE-2025-42599 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2025-42599), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
