What is the CVSS score of CVE-2025-65319?

CVE-2025-65319 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.5%.

Which versions of BlueMail are affected by CVE-2025-65319?

BlueMail 1.140.103 and earlier on Windows contains a critical protection-mechanism bypass that allows attackers to deliver malware via email attachments without triggering Windows SmartScreen or…

Is there a public PoC exploit available for CVE-2025-65319?

Yes, a public proof-of-concept exploit is available for CVE-2025-65319. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2025-65319?

Within 24 hours: Identify all systems running BlueMail 1.140.103 or earlier; advise users to discontinue use or disable the attachment-interaction feature pending vendor patch availability. Within 7 days: Implement compensating controls (see below); reinforce user awareness regarding attachment handling from external senders. Within 30 days: Monitor BlueAirMail (vendor) for patch release; plan migration to alternative email client (Outlook, Thunderbird, or web-based alternatives) for affected users; validate migration completion across organization.

BlueMail CVE-2025-65319

CRITICAL

Protection Mechanism Failure (CWE-693)

2025-12-16 cve@mitre.org

Authentication Bypass Microsoft Bluemail

9.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Malicious file delivered over network but victim must save and open the attachment, so UI:R (not UI:N); bypassing MOTW enables high-integrity/confidentiality payload execution, no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 03:27 vuln.today

CVE Published

Dec 16, 2025 - 16:15 cve.org

CRITICAL 9.1

DescriptionCVE.org

When using the attachment interaction functionality, Blue Mail 1.140.103 and below saves documents to a file system without a Mark-of-the-Web tag, which allows attackers to bypass the built-in file protection mechanisms of both Windows OS and third-party software.

AnalysisAI

Protection-mechanism bypass in BlueMail 1.140.103 and earlier on Windows lets attackers deliver files that are saved via the attachment-interaction feature without a Mark-of-the-Web (MOTW) tag, defeating Windows SmartScreen, Office Protected View, and third-party security software that rely on the MOTW zone identifier. Publicly available exploit code exists; the flaw is not listed in CISA KEV and EPSS is low (0.48%, 38th percentile), indicating no confirmed widespread exploitation yet. The practical effect is that a malicious document or executable arriving by email loses the 'downloaded from the Internet' provenance that would normally trigger a warning or block.

Technical ContextAI

The issue stems from how BlueMail's Windows client writes attachments to the local file system. On Windows/NTFS, files originating from untrusted zones are tagged with the Zone.Identifier Alternate Data Stream - the Mark-of-the-Web - which downstream defenses (SmartScreen, Office Protected View, macro-blocking policies, AppLocker/Smart App Control heuristics, and many EDR/AV products) consult before allowing execution or active content. Per CWE-693 (Protection Mechanism Failure), BlueMail does not attach this MOTW tag when persisting attachment data, so the OS-level trust boundary is silently removed rather than a new code path being introduced. The affected build is identified by CPE cpe:2.3:a:blixhq:bluemail:*:*:*:*:*:windows:*:* (Blix Inc.'s BlueMail), scoped specifically to the Windows platform where MOTW semantics apply.

RemediationAI

Upgrade BlueMail for Windows to a release later than 1.140.103 that correctly applies the Mark-of-the-Web tag to saved attachments; no exact fixed version number was supplied in the input data, so confirm the patched build directly with Blix (BlueMail) before deployment - do not rely on a version invented here. As compensating controls until patched: instruct users not to use the in-app save/open attachment flow and instead route attachments through a browser or client that preserves MOTW; enforce Office 'Block macros from running in files from the Internet' and keep Protected View mandatory (note these policies lose effect precisely because MOTW is stripped, so pair them with attachment sandboxing at the mail gateway); apply application allowlisting (AppLocker/WDAC) so unknown executables cannot run regardless of MOTW state (trade-off: administrative overhead and potential blocking of legitimate tools); and consider blocking or quarantining high-risk attachment types (.exe, .js, .hta, macro-enabled Office) at the email gateway, which reduces convenience but removes the delivery vector. Reference the public tracking repository https://github.com/bbaboha/CVE-2025-65318-and-CVE-2025-65319 for technical detail.