CVE-2025-42599
Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability
Description
CVE-2025-42599 is a critical stack-based buffer overflow vulnerability in Qualitia Active! Mail 6, a widely deployed enterprise email solution. The flaw allows a remote unauthenticated attacker to send a specially crafted request that triggers a stack-based buffer overflow, leading to arbitrary code execution and/or denial of service (DoS) on the mail server. With a CVSS v3.1 score of 9.8 (CRITICAL) and no authentication or user interaction required, this vulnerability represents a severe threat to any organization running affected versions. CISA has added CVE-2025-42599 to the Known Exploited Vulnerabilities catalog, and the EPSS score of 8.01% at the 91.95th percentile indicates a significant probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| qualitia | active\! mail | < 6.60.05008562 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://jvn.jp/en/jp/JVN22348866/(Third Party Advisory)
- https://www.qualitia.com/jp/news/2025/04/18_1030.html(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-42599(US Government Resource)
Weakness Type
CWE-121: Stack-based Buffer Overflow
CVE-2025-42599 is classified under CWE-121 (Stack-based Buffer Overflow), which occurs when a program writes data beyond the boundaries of a stack-allocated buffer. In Qualitia Active! Mail 6, the application processes incoming requests without adequately validating input length, allowing an attacker to overwrite adjacent memory on the stack. This class of vulnerability is particularly dangerous because it can enable the attacker to overwrite the function return address, redirecting execution flow to attacker-controlled code.
Learn more: CWE-121 — Stack-based Buffer Overflow
Impact Analysis
CVE-2025-42599 has a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting maximum exploitability and impact. The vulnerability is remotely exploitable over the network (AV:N) with low complexity (AC:L), requires no authentication (PR:N) and no user interaction (UI:N). Confidentiality (High): Successful exploitation through arbitrary code execution grants the attacker access to all email data stored on and processed by the Active! Mail server, including potentially sensitive corporate communications, attachments, and user credentials. Integrity (High): The attacker can modify email content, inject malicious messages, alter server configurations, and install persistent backdoors. Availability (High): Even without achieving code execution, the buffer overflow can reliably crash the mail service, causing denial of service that disrupts email communications for the entire organization. The EPSS score of 8.0% at the 91.9th percentile indicates a significant probability of exploitation, confirming active targeting of this vulnerability.
Exploit Maturity
CVE-2025-42599 has been confirmed as actively exploited in the wild, as indicated by its inclusion in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of May 19, 2025. The EPSS score of 8.0% at the 91.9th percentile indicates a significant probability of exploitation. The Japan Vulnerability Notes advisory (JVN#22348866) and the Qualitia vendor advisory (qualitia.com) provide official details. Stack-based buffer overflow vulnerabilities in network-facing services like email servers are highly attractive targets because they can be triggered remotely without authentication, and well-established exploitation techniques exist for this class of vulnerability. Email servers are particularly valuable targets as they contain sensitive communications and often serve as a pivot point for further network intrusion.
Remediation
-
Update Active! Mail immediately. Upgrade Qualitia Active! Mail 6 to BuildInfo 6.60.05008562 or later. Consult the Qualitia security advisory for specific upgrade procedures and compatibility information.
-
Implement network-level protections. Deploy a Web Application Firewall (WAF) or intrusion prevention system (IPS) with rules to detect and block oversized or malformed requests targeting the Active! Mail service. Rate-limit incoming connections to reduce the impact of exploitation attempts.
-
Restrict network exposure. If possible, limit access to the Active! Mail service to trusted IP ranges or place it behind a reverse proxy that performs input validation. Avoid exposing the mail server directly to the internet without protective controls.
-
Monitor for exploitation indicators. Review server logs for crash events, unusual process behavior, or unexpected network connections that could indicate successful exploitation. Set up alerting for Active! Mail service restarts or abnormal memory usage patterns.
-
Prepare incident response procedures. Given the critical nature of email infrastructure, ensure incident response plans are in place to handle potential compromise, including procedures for isolating the mail server, preserving forensic evidence, and notifying affected users if email data may have been accessed.
Technical Details
CVE-2025-42599 is a stack-based buffer overflow vulnerability in Qualitia Active! Mail 6. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms this is a remotely exploitable vulnerability with no barriers to exploitation and maximum impact across all CIA dimensions.
The vulnerability exists in the request processing logic of the Active! Mail 6 application. When the server receives a specially crafted request from a remote attacker, it copies request data into a stack-allocated buffer without properly checking the length of the input. This allows the attacker to overflow the buffer, overwriting adjacent stack memory including saved registers and the function return address. By carefully crafting the overflow payload, the attacker can redirect execution to arbitrary code, achieving remote code execution on the mail server. Even if precise code execution is not achieved, the stack corruption reliably crashes the service, resulting in a denial-of-service condition. Affected versions include all Active! Mail 6 builds up to and including BuildInfo 6.60.05008561, and the fix in BuildInfo 6.60.05008562 implements proper bounds checking on the vulnerable input processing path.
Frequently Asked Questions
Is CVE-2025-42599 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2025-42599 to the Known Exploited Vulnerabilities catalog. The EPSS score of 8.01% at the 91.95th percentile indicates significant exploitation probability.
What products are affected by CVE-2025-42599?
Qualitia Active! Mail 6 with BuildInfo 6.60.05008561 and earlier versions are affected. All deployments of Active! Mail 6 that have not been updated to BuildInfo 6.60.05008562 or later are vulnerable.
How do I fix CVE-2025-42599?
Upgrade Active! Mail 6 to BuildInfo 6.60.05008562 or later. As an interim mitigation, implement network-level protections such as WAF rules and restrict access to the mail service from untrusted networks.
How severe is CVE-2025-42599?
With a CVSS v3.1 score of 9.8 (CRITICAL), CVE-2025-42599 is extremely severe. It allows unauthenticated remote code execution or denial of service with no user interaction, potentially compromising all email data and disrupting communications for the entire organization.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.