Security readout for executives and security teams
Plain-English summary
CVE-2019-25364 is a critical remote buffer overflow in TABS Laboratories Win10 MailCarrier 2.51. A remote, unauthenticated attacker could potentially run code on the mail server by sending malformed POP3 login data. Treat internet-facing POP3 services running this version as high priority.
Executive priority
High urgency for any organization running Win10 MailCarrier 2.51 with POP3 exposed. Confirm exposure quickly, restrict access, and seek vendor guidance. If no fix is available, plan replacement or isolation of the affected service.
Technical view
The issue is a stack-based buffer overflow (CWE-121) in the POP3 USER command in Win10 MailCarrier 2.51. The CVSS 3.1 score is 9.8, with network attack vector, low complexity, no privileges, and no user interaction. Public exploit reference exists, but the provided sources do not prove active exploitation.
Likely exposure
Exposure is limited to organizations running Win10 MailCarrier 2.51, especially where the POP3 service is reachable from untrusted networks or the internet.
Exploitation context
ExploitDB is listed as a public exploit reference. The source bundle does not show CISA KEV listing or confirmed in-the-wild exploitation. The risk remains serious because exploitation is remote, unauthenticated, and may lead to code execution.
Researcher notes
Evidence comes from the CVE record, VulnCheck advisory, and ExploitDB reference. The affected product/version is Win10 MailCarrier 2.51 only in the provided sources. No vendor patch details or active exploitation confirmation were included in the source bundle.
Mitigation direction
- Identify whether Win10 MailCarrier 2.51 is deployed.
- Restrict POP3 access to trusted networks only.
- Disable POP3 if it is not business-required.
- Check TABS Laboratories guidance for updates or replacement options.
- Prioritize migration if no supported fixed version is available.
Validation and detection
- Inventory mail servers and installed Win10 MailCarrier versions.
- Confirm whether POP3 is listening on exposed interfaces.
- Review firewall rules for external POP3 access.
- Check vulnerability scanner coverage for CVE-2019-25364.
- Monitor mail server logs for abnormal POP3 USER activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-121: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2019-25364 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9VulnCheckCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-47554CVE reference, VulnCheck · exploit
- Vendor HomepageCVE reference, VulnCheck · product
- VulnCheck Advisory: Win10 MailCarrier 2.51 - 'POP3 User' Remote Buffer OverflowCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Stack-based Buffer Overflow
Stack-based Buffer Overflow represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.