CVE-2025-42599

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Sep 24, 2026

Description

Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a specially crafted request created and sent by a remote unauthenticated attacker may lead to arbitrary code execution and/or a denial-of-service (DoS) condition.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121

Affected software

Vendor	Product	Versions
QUALITIA CO., LTD.	Active! mail 6	BuildInfo: 6.60.05008561 and earlier

References

https://jvn.jp/en/jp/JVN22348866/Third Party Advisory
https://www.qualitia.com/jp/news/2025/04/18_1030.htmlVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-42599US Government Resource

Timeline

Published: Apr 18, 2025
Last modified: Sep 24, 2026
Added to CISA KEV: Apr 28, 2025
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-42608.3A vulnerability was found in zhangyanbo2007 youkefu up to 4.2.0 and classified as problematic. Affected by this issue is the function impsav CVE-2025-426008.2This vulnerability exists in Meon KYC solutions due to missing restrictions on the number of incorrect One-Time Password (OTP) attempts thro CVE-2025-426018.2This vulnerability exists in Meon KYC solutions due to insufficient server-side validation of the Captcha in certain API endpoints. A remote CVE-2025-426028.2This vulnerability exists in Meon KYC solutions due to improper handling of access and refresh tokens in certain API endpoints of authentica CVE-2025-426038.7This vulnerability exists in the Meon KYC solutions due to transmission of sensitive data in plain text within the response payloads of cert CVE-2025-426046.9This vulnerability exists in Meon KYC solutions due to debug mode is enabled in certain API endpoints. A remote attacker could exploit this CVE-2025-426059.3This vulnerability exists in Meon Bidding Solutions due to improper authorization controls on certain API endpoints for the initiation, modi CVE-2025-42615.3A vulnerability was found in GAIR-NLP factool up to 3f3914bc090b644be044b7e0005113c135d8b20f. It has been classified as critical. This affec CVE-2025-426116.5RouterOS provides various services that rely on correct verification of client and server certificates to secure confidentiality and integri CVE-2025-426158.1In affected versions, vulnerability-lookup did not track or limit failed One-Time Password (OTP) attempts during Two-Factor Authentication CVE-2025-426167.0Some endpoints in vulnerability-lookup that modified application state (e.g. changing database entries, user data, configurations, or othe CVE-2025-42629.8A vulnerability was found in PHPGurukul Online DJ Booking Management System 1.0. It has been declared as critical. This vulnerability affect