CVE-2025-42599

What it actually does

Active! mail 6 BuildInfo 6.60.05008561 and earlier contains a remotely reachable stack-based buffer overflow. A specially crafted unauthenticated request can overwrite stack memory in the vulnerable service, potentially allowing remote code execution in the context of the mail application process or causing the process to crash, resulting in denial of service. Because exploitation is remote and does not require authentication, the vulnerability has a critical technical impact when the service is exposed to untrusted networks.

Why it matters to the business

Successful exploitation can let an attacker take control of a vulnerable mail server, disrupt email availability, access or manipulate sensitive mail data, and use the compromised system as a foothold for broader intrusion. The vulnerability is listed in CISA KEV with a remediation due date of 2025-05-19 and is reported as actively exploited in the wild, so unpatched internet-facing deployments should be treated as urgent exposure even though the EPSS score is moderate.

How an attack unfolds

An attacker identifies an exposed Active! mail 6 service running BuildInfo 6.60.05008561 or earlier. They send a specially crafted request to the vulnerable endpoint or protocol handler without needing valid credentials. The malformed input triggers a stack-based buffer overflow, corrupting process memory. Depending on exploit reliability, this may crash the service and cause a denial-of-service condition, or redirect execution flow to attacker-controlled code. If remote code execution succeeds, the attacker can run commands with the privileges of the Active! mail process, deploy web shells or tooling, access mail data, establish persistence, and pivot to other internal systems. Public reporting indicates active exploitation under the Qualitia Active! Mail stack-based buffer overflow activity label, so exploitation attempts should be assumed possible against exposed vulnerable systems.

How to fix it

Upgrade Active! mail 6 to a vendor-fixed build later than BuildInfo 6.60.05008561 as soon as possible. If a fixed build is not immediately available, apply vendor-provided patches or mitigations, restrict external access to the Active! mail service, place it behind a VPN or trusted reverse proxy where feasible, enforce network allowlisting for administrative and mail-related interfaces, and monitor closely for crashes or suspicious requests. Because this vulnerability is in the CISA Known Exploited Vulnerabilities catalog, organizations subject to BOD 22-01 should have remediated it by 2025-05-19; all organizations should prioritize remediation for any internet-facing instance.

How to confirm the fix worked

Confirm the installed Active! mail 6 BuildInfo is newer than 6.60.05008561 or that the vendor patch is installed. Validate that exposed services are no longer reachable from untrusted networks unless intentionally required and protected. Review configuration and access controls after patching. Perform a controlled vulnerability scan or authenticated version check to verify the vulnerable build is not present. Confirm service stability after remediation and ensure no unexplained restarts, crash dumps, or suspicious child processes remain.

Typical attack path

1. Scan the internet or target address ranges for exposed Active! mail 6 services.
2. Fingerprint the service version or BuildInfo to identify systems at or below 6.60.05008561.
3. Send a crafted unauthenticated request designed to trigger the stack-based buffer overflow.
4. Cause a service crash for denial of service or achieve control of instruction flow for remote code execution.
5. Execute commands under the mail service account, drop tooling, or create persistence.
6. Access email content, credentials, configuration files, or use the server as a pivot point for further compromise.

How to detect it

To determine whether exploitation already occurred, review Active! mail application logs, web server or reverse proxy logs, network IDS logs, EDR telemetry, operating system event logs, and crash dumps from before and after patching. Look for unauthenticated requests with unusually long parameters, malformed headers, binary payloads, repeated failed requests followed by service crashes, or traffic from unfamiliar internet sources. Correlate service crashes or restarts with inbound requests to the mail service. On compromised hosts, hunt for unexpected child processes spawned by the Active! mail service, such as command shells, scripting engines, download utilities, archive tools, or network utilities. Review file system changes in web-accessible or application directories for newly created scripts, binaries, or web shells. Investigate anomalous outbound connections from the mail server, especially to unknown IP addresses shortly after suspicious requests or crashes. Include threat-hunting context for activity publicly associated with Qualitia Active! Mail stack-based buffer overflow exploitation, but do not rely on actor naming alone because payloads and infrastructure can vary.

• Active! mail 6 BuildInfo: 6.60.05008561
• BuildInfo: 6.60.05008561
• Active! mail service crash
• stack buffer overflow
• Stack-based buffer overflow
• segmentation fault
• access violation
• STATUS_STACK_BUFFER_OVERRUN
• 0xc0000409
• cmd.exe spawned by Active! mail
• /bin/sh spawned by Active! mail
• powershell.exe spawned by Active! mail
• curl spawned by Active! mail
• wget spawned by Active! mail

What your security team should do

• Immediately inventory all Active! mail 6 deployments, prioritizing internet-facing systems.
• Patch or upgrade any instance running BuildInfo 6.60.05008561 or earlier.
• If patching is delayed, restrict access using firewall rules, VPN, reverse proxy controls, or source IP allowlisting.
• Because the vulnerability is KEV-listed and actively exploited, initiate threat hunting on vulnerable or formerly vulnerable systems.
• Review mail server logs, web/proxy logs, process creation telemetry, crash dumps, and EDR alerts for exploitation attempts or post-exploitation activity.
• Check for unexpected files, new accounts, scheduled tasks, unusual outbound connections, credential access, and mail data exfiltration indicators.
• After remediation, rotate credentials stored on or used by exposed mail servers if compromise cannot be ruled out.
• Increase monitoring for Active! mail process crashes, abnormal child processes, and unauthenticated malformed request patterns.