The vulnerability CVE-2025-65318 affects Canary Mail up to version 5.1.40. When users interact with attachments, the application saves these files without embedding the Mark-of-the-Web tag, a security feature used by Windows and some third-party software to identify files downloaded from the internet or other untrusted sources. Without this tag, the files are treated as trusted, enabling attackers to circumvent built-in protections that would normally warn users or restrict file execution. The CVSS v3.1 base score is 9.1, indicating a critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact.

Attackers can exploit this vulnerability to bypass Windows and third-party file protection mechanisms by delivering malicious attachments that are saved without the Mark-of-the-Web tag. This increases the risk of executing malicious files without warning, potentially leading to unauthorized disclosure or modification of sensitive information. There is no known exploitation in the wild at this time.

No official patch or fix information is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should exercise caution when handling attachments in Canary Mail, especially from untrusted sources. Consider using additional endpoint protection solutions that do not rely solely on Mark-of-the-Web tags for file trust decisions.