CVE-2025-65319: 
NixOS vulnerability analysis and mitigation

CVE-2025-65319 is a protection mechanism failure vulnerability in Blue Mail for Windows that allows attackers to bypass built-in file protection by exploiting the application's failure to apply Mark-of-the-Web (MotW) tags to saved attachments. It affects Blue Mail version 1.140.103 and below on Windows. The vulnerability was published on December 16, 2025, and is classified under CWE-693 (Protection Mechanism Failure). It carries a CVSS v3.1 base score of 9.1 (Critical) (Feedly, GitHub PoC).

The root cause is Blue Mail's failure to tag files saved from email attachments with the Windows Mark-of-the-Web (MotW) attribute (CWE-693). MotW is an NTFS Alternate Data Stream (Zone.Identifier) that Windows and security software use to identify files originating from the internet, triggering Protected View in Office, SmartScreen warnings, and other security controls. When Blue Mail saves or opens an attachment via "Open with" or "Save as" dialogs, it writes the file to disk without this tag, causing Windows and third-party security tools to treat the file as locally trusted. The PoC demonstrates chaining this bypass with CVE-2017-11882 (Microsoft Office Equation Editor RCE) and Remote Template Injection: a malicious DOCX with an embedded remote template link is delivered as an attachment, and when opened through Blue Mail, it fetches and executes a malicious RTF payload without triggering Office Protected View (GitHub PoC, RTI-Toolkit).

Successful exploitation allows malicious files delivered via email attachments to execute with reduced security restrictions, bypassing Windows SmartScreen, Office Protected View, and third-party endpoint security controls that rely on MotW. When chained with a secondary vulnerability such as CVE-2017-11882, this can result in remote code execution on the victim's system, enabling data theft, credential harvesting, and full system compromise. The CVSS score reflects high confidentiality and integrity impact with no availability impact, and the network-based attack vector with no required user interaction (beyond normal email use) makes this particularly dangerous (Feedly, GitHub PoC).

Public proof-of-concept code and a video demonstration are available on GitHub, and a technical write-up is hosted on Google Drive (GitHub PoC, Google Drive PoC). As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.018% (0.000180), indicating low but non-zero probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Prepare malicious RTF payload: On the attacker's host, use the CVE-2017-11882 exploit script to generate a malicious RTF file (exploit.rtf) that executes arbitrary commands (e.g., opens a reverse shell or calculator) when processed by Microsoft Office Word 16 or below.
2. Set up Remote Template Injection server: Deploy a Flask-based HTTP server (as shown in the PoC) that serves exploit.rtf at a known URL (e.g., http://attacker.com:5000/download).
3. Craft malicious DOCX: Create an arbitrary DOCX document and use the RTI-Toolkit (PS-Templator.ps1 Invoke-Regular) to embed a remote template link pointing to the attacker's server URL within the DOCX's word/_rels/settings.xml.rels.
4. Deliver to victim: Send the malicious DOCX as an email attachment to the target Blue Mail user.
5. Victim opens attachment: The victim uses Blue Mail's "Open with" or "Save as" functionality to open the DOCX. Blue Mail saves the file to disk without a MotW (Zone.Identifier) tag.
6. Security controls bypassed: Because the file lacks MotW, Office opens it without Protected View and without SmartScreen warnings, and the embedded remote template link is fetched automatically.
7. Payload execution: Office retrieves exploit.rtf from the attacker's server and processes it, triggering CVE-2017-11882 and executing the attacker's payload without any additional user interaction (GitHub PoC, RTI-Toolkit).

• Network: Outbound HTTP/HTTPS requests from the victim machine to unknown external servers shortly after opening an email attachment in Blue Mail; requests to URLs matching patterns like /download serving .rtf or .docm files from non-corporate infrastructure.
• File System: Attachment files saved in Blue Mail's temporary or attachment storage directory lacking the Zone.Identifier Alternate Data Stream (verify with Get-Item <file> -Stream *); presence of unexpected .rtf, .docm, or .dotm files in user temp directories without MotW tags.
• Process: Unusual child processes spawned by WINWORD.EXE or EQNEDT32.EXE (e.g., cmd.exe, powershell.exe, calc.exe, curl.exe); EQNEDT32.EXE launching with unexpected command-line arguments.
• Logs: Windows Event Logs showing process creation events (Event ID 4688) with EQNEDT32.EXE or WINWORD.EXE as parent process; network connection events from Office processes to external IPs (GitHub PoC).

Upgrade Blue Mail to a version above 1.140.103, which addresses the MotW omission in attachment handling (Feedly). As interim mitigations, restrict or disable the "Open with" and "Save as" attachment features in Blue Mail, and implement endpoint protection controls to monitor and block suspicious file executions from attachment storage directories. Additionally, ensure Microsoft Office is updated beyond version 16 to eliminate the secondary CVE-2017-11882 attack chain, and consider enabling Attack Surface Reduction (ASR) rules to block Office from creating child processes (GitHub PoC).