by Kastro
Paper/Archive/CVE-2025-42599

CVE-2025-42599

QUALITIA CO., LTD. Active! mail 6 — Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability

KEV · due 19 MayEPSS 3%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
97
CVSS 9.8 (CNA)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 88.7.887 × 2017.7Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a specially crafted request created and sent by a remote unauthenticated attacker may lead to arbitrary code execution and/or a denial-of-service (DoS) condition.

Affected

ProductAffectedFixed inSource
Active! mail 6BuildInfo: 6.60.05008561 and earlier–CNA

Scores by source

jpcert (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refqualitia.com/jp/news/2025/04/18_1030.htmlrefjvn.jp/en/jp/JVN22348866refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-42599kevcisa.gov/known-exploited-vulnerabilities-catalog