Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Apr 17, 2025 · Catalog

   Detected

   Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a specially crafted request created and sent by a remote unauthenticated attacker may lead to arbitrary code execution and/or a denial-of-service (DoS) condition.

2. Apr 28, 2025 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

3. May 19, 2025 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

4. Sep 24, 2026 · Catalog

   Updated

   Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a specially crafted request created and sent by a remote unauthenticated attacker may lead to arbitrary code execution and/or a denial-of-service (DoS) condition.

Affected

• cpe qualitia/active! mailversion unspecified
• vendor Qualitia Active! Mailversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2025-42599

  Qualitia Active! Mail contains a stack-based buffer overflow vulnerability that allows a remote, unauthenticated attacker to execute arbitrary or trigger a denial-of-service via a specially crafted request.

  cisa.gov
• CVE.orgVulnerability recordCVE-2025-42599

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2025-42599

  30-day exploitation probability 3.3%

  first.org
• NIST NVDVulnerability recordCVE-2025-42599

  Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a specially crafted request created and sent by a remote unauthenticated attacker may lead to arbitrary code execution and/or a denial-of-service (DoS) condition.

  nvd.nist.gov

References

• Third Party Advisory · jvn.jp
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov
• CISA note · qualitia.com