Skip to main content

Active Mail CVE-2025-42599

CRITICAL
Stack-based Buffer Overflow (CWE-121)
2025-04-18 vultures@jpcert.or.jp
RCE Buffer Overflow Stack Overflow Active Mail
9.8
CVSS 3.1
Share

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Analysis Generated
Mar 28, 2026 - 18:37 vuln.today
Added to CISA KEV
Oct 24, 2025 - 17:00 cisa
CISA KEV
CVE Published
Apr 18, 2025 - 04:15 nvd
CRITICAL 9.8

DescriptionNVD

Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a specially crafted request created and sent by a remote unauthenticated attacker may lead to arbitrary code execution and/or a denial-of-service (DoS) condition.

AnalysisAI

Active! mail 6 contains a stack-based buffer overflow allowing unauthenticated remote code execution and denial of service through crafted requests, exploited in attacks against Japanese organizations in April 2025.

Technical ContextAI

The CWE-121 stack overflow in Active! mail's request processing allows crafted requests to overflow a stack buffer, enabling arbitrary code execution on the mail server.

RemediationAI

Apply vendor patches. Restrict access to the Active! mail web interface. Monitor for unauthorized access to email data.

Share

CVE-2025-42599 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy