Skip to content
Cyber Threat
CTI Academy Sponsor CTI Academy
CRITICAL · CVSS 9.8 CISA Known Exploited Vulnerability

CVE-2025-42599

Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability

Qualitia Active! Mail

Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a specially crafted request created and sent by a remote unauthenticated attacker may lead to arbitrary code execution and/or a denial-of-service (DoS) condition.

CVSS
9.8
CRITICAL
EPSS
3.3%
30-day exploitation
Ransomware groups
0
recorded exploiting
Published
18 Apr 2025
CWE-121

Exploitation status

CISA Known Exploited Vulnerabilities

Listed by CISA on 28 April 2025. US federal agencies were required to remediate it by 19 May 2025.

EPSS — exploitation probability

FIRST puts the probability of exploitation activity in the next 30 days at 3.3%, which is higher than 88.2% of all scored vulnerabilities. EPSS is a forecast of activity, not a measure of severity, and it is rescored daily.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Frequently asked questions

Is CVE-2025-42599 being exploited by ransomware groups?

No ransomware group in this database is currently recorded as exploiting CVE-2025-42599.

What does CVE-2025-42599 affect?

CVE-2025-42599 affects Qualitia Active! Mail. Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a specially crafted request created and sent by a remote unauthenticated attacker may lead to arbitrary code execution and/or a denial-of-service (DoS) condition.

How severe is CVE-2025-42599?

CVE-2025-42599 is rated CRITICAL with a CVSS base score of 9.8. EPSS puts the probability of exploitation in the next 30 days at 3.3%, higher than 88.2% of all scored vulnerabilities. It is listed in the CISA Known Exploited Vulnerabilities catalog, with a federal remediation deadline of 19 May 2025.

How should organisations respond to CVE-2025-42599?

Apply the vendor patch for Qualitia Active! Mail as the first priority, and treat any internet-facing instance as the most urgent. Because this vulnerability is associated with ransomware activity, also review whether the affected systems were reachable before patching, rather than assuming that patching alone closes the incident.