CVE-2025-65319

Critical · CVSS 9.1

Blue Mail — Mark-of-the-Web (MotW) bypass - missing zone identifier tag on downloaded files

CVSS: 9.1; nvd
EPSS: —
KEV: No
Class: other; CWE-693

Description

When using the attachment interaction functionality, Blue Mail 1.140.103 and below saves documents to a file system without a Mark-of-the-Web tag, which allows attackers to bypass the built-in file protection mechanisms of both Windows OS and third-party software.

Search profile — drives PoC discovery

Symbols Mark-of-the-WebMotWZone.Identifierattachment interactionCVE-2025-65319CVE-2025-65318RTI-Toolkit

Keywords Blue Mail MotW bypassCVE-2025-65319CVE-2025-65318Blue Mail attachment Mark-of-the-WebBlue Mail 1.140.103Zone.Identifier bypass email clientbbaboha CVE-2025-65318-and-CVE-2025-65319CWE-693 protection mechanism failure email

Versions: <= 1.140.103

Ranked PoCs (1) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

bbaboha/CVE-2025-65318-and-CVE-2025-65319 needs review

cited in references

gh_search

★ 7

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-06T06:30:39.000Z