Critical stack-based buffer overflow in Active
Critical stack-based buffer overflow in Active! mail webmail system (CVE-2025-42599) is being actively exploited for remote code execution and DoS attacks.
Japan's IPA has issued an urgent security alert regarding Active! mail, a webmail system developed by QualityA Corporation. The product contains a critical stack-based buffer overflow vulnerability (CVE-2025-42599) that allows remote, unauthenticated attackers to execute arbitrary code or cause denial-of-service conditions by sending specially crafted requests to vulnerable servers.
The vulnerability affects Active! mail 6 BuildInfo 6.60.05008561 and all earlier versions. According to IPA, active exploitation of this vulnerability has already been observed in the wild, elevating the urgency for immediate patching. The vendor has released a patched version (BuildInfo 6.60.06008562) that addresses the flaw.
Given the critical CVSS score of 9.8, the confirmed active exploitation, and the potential for complete system compromise, organizations running Active! mail should treat this as a high-priority incident and apply the available patch immediately. The vulnerability's network-based attack vector and lack of required authentication make it an attractive target for opportunistic attackers.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by IIS Worker Process (Possible Active! mail Exploitation)
Detects command interpreter or scripting engine processes spawned by the IIS worker process, which may indicate remote code execution following exploitation of a webmail server buffer overflow such as CVE-2025-42599. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process from IIS Worker Process
id: d112c02e-febb-5aa0-9191-4c419fa909f4
status: experimental
description: Detects cmd.exe, powershell.exe or scripting engines spawned as children
of w3wp.exe (IIS worker process). Active! mail and similar webmail products are
commonly hosted behind IIS; unexpected shell or scripting child processes following
a remote request may indicate successful exploitation of a memory-corruption vulnerability
such as CVE-2025-42599 (stack-based buffer overflow) leading to arbitrary code execution.
references:
- https://www.ipa.go.jp/
author: Vorant
tags:
- attack.t1190
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \w3wp.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \cscript.exe
- \wscript.exe
- \rundll32.exe
- \mshta.exe
- \certutil.exe
filter:
CommandLine|contains:
- IISReset
- AppPoolRecycle
condition: selection and not filter
falsepositives:
- Legitimate IIS management or health-check scripts that invoke command-line utilities
- Third-party application pools that intentionally spawn helper scripts under w3wp.exe
level: medium
Exploitation Attempt Against Webmail Service via Malformed Request Causing Crash
Detects abnormal termination (crash/restart) of a webmail application service process shortly after receiving network traffic, consistent with a stack-based buffer overflow exploitation attempt causing denial of service, as seen with CVE-2025-42599. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Webmail Service Process Crash Following Exploit Attempt
id: daf5a45f-5d24-54a6-86d0-d7136e4439fc
status: experimental
description: Detects unexpected termination or restart events (Windows Error Reporting
or service control manager crash events) for a webmail/mail server service process,
which may indicate a remote unauthenticated attacker triggered a stack-based buffer
overflow (e.g., CVE-2025-42599) resulting in denial of service. This should be correlated
with recent inbound connections to the webmail service port over a short time window.
references:
- https://www.ipa.go.jp/
author: Vorant
tags:
- attack.t1190
- attack.impact
logsource:
product: windows
service: application
detection:
selection:
Provider_Name: Application Error
EventID: 1000
keyword_filter:
Message|contains:
- mail
- webmail
condition: selection and keyword_filter
falsepositives:
- Unrelated application crashes on the same host that coincidentally reference mail-related
components
- Legitimate service restarts during maintenance windows
level: low
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2025/20250418-jvn.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free