CVE-2025-7962 describes an SMTP Injection vulnerability in Eclipse Foundation's Jakarta Mail prior to version 2.0.2. The issue arises from improper neutralization of input terminators (CWE-147), where the presence of carriage return (\r) and newline (\n) UTF-8 characters allows an attacker to separate and inject multiple SMTP messages. This could potentially lead to unauthorized SMTP command execution within affected versions.

Successful exploitation could allow an attacker with limited privileges to perform SMTP Injection, potentially manipulating email sending behavior. The CVSS vector indicates network attack vector, high attack complexity, and limited privileges required, with no user interaction needed. The impact includes high integrity and low system impact, with limited scope change.

No explicit patch link or vendor advisory is provided. The affected version is prior to 2.0.2, which implies that upgrading to version 2.0.2 or later is the recommended remediation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.