CVE Watch24 sept 2026

CVE-2025-42599

Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability

CVSS

9.8

Crítico

EPSS

3.3%

p88

KEV

SÍ

28 abr 2025

Exploit Today

0-100

Publicado: 18 abr 2025 · Última mod.: 24 sept 2026 · CWE-121

EPSS · 30d

3.3%EPSS · 30 días3.3%

2026-09-182026-10-15

Ficha del catálogo KEV

Producto

Qualitia / Active! Mail

Vulnerabilidad

Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability

Añadido a KEV

28 abr 2025

Remediar antes de

19 may 2025

Uso conocido en ransomware

Descripción resumida

Qualitia Active! Mail contains a stack-based buffer overflow vulnerability that allows a remote, unauthenticated attacker to execute arbitrary or trigger a denial-of-service via a specially crafted request.

Acción requerida

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notas

https://www.qualitia.com/jp/news/2025/04/18_1030.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-42599

Descripción técnica

Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a specially crafted request created and sent by a remote unauthenticated attacker may lead to arbitrary code execution and/or a denial-of-service (DoS) condition.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1117119.8 CRÍ

—

———Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. Unauthenticated attackers can send a username longer than 63 bytes to any protected /router/*.cgi route to crash the main Boa process or potentially execute code.5h CVE-2026-1026939.6 CRÍ

—

———RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.04, the ATWINC15x0 driver's _atwinc15x0_sta_set_current_ssid function uses strcpy to copy an SSID without checking the destination size. When MODULE_ATWINC15X0_DYNAMIC_CONNECT is enabled, a nearby attacker can advertise a malformed or oversized SSID that is processed during Wi-Fi scanning, causing memory corruption and potentially a hard fault, denial of service, or code execution. This issue is fixed in version 2026.04.4h CVE-2026-1084458.8 ALT

—

———Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.5h CVE-2026-1084408.8 ALT

—

———Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.5h CVE-2026-1084318.8 ALT

—

———Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.5h CVE-2026-798407.3 ALT

—

——0A buffer overflow vulnerability in HPE NonStop XABroker may cause memory corruption, resulting in application crash.1d