CVE-2025-42599: critical vulnerability in QUALITIA CO., LTD. Active! mail 6
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Active! mail 6 version 6.60.05008561 and earlier has a flaw that allows an attacker to send a specially crafted message that overflows a memory buffer, potentially letting them run malicious code or crash the system without needing a password.
A stack-based buffer overflow (CWE-121) exists in Active! mail 6 affecting versions up to 6.60.05008561. A remote unauthenticated attacker can send a crafted request that overflows stack memory, resulting in arbitrary code execution or denial-of-service. No authentication is required for exploitation.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.