MDaemon 23.5.2 Header From input validation

Summaryinfo

A vulnerability, which was classified as problematic, has been found in MDaemon 23.5.2. This issue affects some unknown processing of the component Header Handler. Performing a manipulation of the argument From results in an unknown weakness. This vulnerability is cataloged as CVE-2025-61084. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in MDaemon 23.5.2. It has been classified as problematic. This affects an unknown functionality of the component Header Handler. The manipulation of the argument From with an unknown input leads to a unknown weakness. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on integrity. The summary by CVE is:

MDaemon Mail Server 23.5.2 validates SPF, DKIM, and DMARC using the email enclosed in angle brackets (<>) in the From: header of SMTP DATA. An attacker can craft a From: header with multiple invisible Unicode thin spaces to display a spoofed sender while passing validation, allowing email spoofing even when anti-spoofing protections are in place. NOTE: this is disputed by the Supplier because UI spoofing occurs in a client, not in a server such as MDaemon's product or any other server implementation. Also, if a client without its own spoofing protection must be used, the Header Screening feature in MDaemon's product can be employed to mitigate the client-side vulnerability.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2025-61084 since 09/26/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 11/13/2025).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Mail Server Software

Name

• MDaemon

Version

• 23.5.2

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion