CVE-2025-42599

QUALITIA CO., LTD. Active! mail 6

Published 18 Apr 2025 · updated 24 Sept 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 28 Apr 2025, with a remediation deadline of 19 May 2025 for US federal agencies.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a specially crafted request created and sent by a remote unauthenticated attacker may lead to arbitrary code execution and/or a denial-of-service (DoS) condition.

References

jvn.jp/en/jp/JVN22348866/ · Third Party Advisory
www.qualitia.com/jp/news/2025/04/18_1030.html · Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-42599 · US Government Resource