Critical stack-based buffer overflow in Active
Critical stack-based buffer overflow in Active! mail webmail system (CVE-2025-42599) is being actively exploited for remote code execution and DoS attacks.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2025-42599 as exploited in the wild.
Japan's IPA has issued an urgent security alert regarding Active! mail, a webmail system developed by QualityA Corporation. The product contains a critical stack-based buffer overflow vulnerability (CVE-2025-42599) that allows remote, unauthenticated attackers to execute arbitrary code or cause denial-of-service conditions by sending specially crafted requests to vulnerable servers.
The vulnerability affects Active! mail 6 BuildInfo 6.60.05008561 and all earlier versions. According to IPA, active exploitation of this vulnerability has already been observed in the wild, elevating the urgency for immediate patching. The vendor has released a patched version (BuildInfo 6.60.06008562) that addresses the flaw.
Given the critical CVSS score of 9.8, the confirmed active exploitation, and the potential for complete system compromise, organizations running Active! mail should treat this as a high-priority incident and apply the available patch immediately. The vulnerability's network-based attack vector and lack of required authentication make it an attractive target for opportunistic attackers.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by IIS Worker Process (Possible Active! mail Exploitation)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects command interpreter or scripting engine processes spawned by the IIS worker process, which may indicate remote code execution following exploitation of a webmail server buffer overflow such as CVE-2025-42599. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process from IIS Worker Process
id: d112c02e-febb-5aa0-9191-4c419fa909f4
status: experimental
description: Detects cmd.exe, powershell.exe or scripting engines spawned as children
of w3wp.exe (IIS worker process). Active! mail and similar webmail products are
commonly hosted behind IIS; unexpected shell or scripting child processes following
a remote request may indicate successful exploitation of a memory-corruption vulnerability
such as CVE-2025-42599 (stack-based buffer overflow) leading to arbitrary code execution.
references:
- https://www.ipa.go.jp/
author: Vorant
tags:
- attack.t1190
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \w3wp.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \cscript.exe
- \wscript.exe
- \rundll32.exe
- \mshta.exe
- \certutil.exe
filter:
CommandLine|contains:
- IISReset
- AppPoolRecycle
condition: selection and not filter
falsepositives:
- Legitimate IIS management or health-check scripts that invoke command-line utilities
- Third-party application pools that intentionally spawn helper scripts under w3wp.exe
level: medium
Exploitation Attempt Against Webmail Service via Malformed Request Causing Crash
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects abnormal termination (crash/restart) of a webmail application service process shortly after receiving network traffic, consistent with a stack-based buffer overflow exploitation attempt causing denial of service, as seen with CVE-2025-42599. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Webmail Service Process Crash Following Exploit Attempt
id: daf5a45f-5d24-54a6-86d0-d7136e4439fc
status: experimental
description: Detects unexpected termination or restart events (Windows Error Reporting
or service control manager crash events) for a webmail/mail server service process,
which may indicate a remote unauthenticated attacker triggered a stack-based buffer
overflow (e.g., CVE-2025-42599) resulting in denial of service. This should be correlated
with recent inbound connections to the webmail service port over a short time window.
references:
- https://www.ipa.go.jp/
author: Vorant
tags:
- attack.t1190
- attack.impact
logsource:
product: windows
service: application
detection:
selection:
Provider_Name: Application Error
EventID: 1000
keyword_filter:
Message|contains:
- mail
- webmail
condition: selection and keyword_filter
falsepositives:
- Unrelated application crashes on the same host that coincidentally reference mail-related
components
- Legitimate service restarts during maintenance windows
level: low
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2025/20250418-jvn.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs