---
title: "Output Messenger CVE-2025-27920: Zero-Day Used for Espionage"
url: https://erroneo.us/security/briefs/output-messenger-cve-2025-27920-directory-traversal/
description: "Directory traversal in Srimax Output Messenger before 2.0.63, used by Türkiye-linked Marbled Dust to backdoor chat servers. Check versions, hunt for implants."
type: security-brief
section: "Security Digest"
date_published: 2024-12-25
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-27920"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Output Messenger CVE-2025-27920: Zero-Day Used for Espionage

**Verdict: Check exposure.** Fixed since December 2024 and used by a state-linked espionage group; anyone still running a self-hosted Output Messenger server older than 2.0.63 should upgrade and check it for the Marbled Dust backdoors, because a later patch does not remove them.

- **Who must act:** Organizations that run a self-hosted Output Messenger server, especially one that ran a build before 2.0.63 while reachable from the internet, or that sits in government, telecom or IT in the Middle East or Europe.
- **Who can relax:** Teams with no Output Messenger anywhere, and those that upgraded promptly, keep the server on an internal network and find none of the indicators below.
- **Affected:** Output Messenger before 2.0.63 (the vendor names 2.0.62)
- **Fixed:** Output Messenger 2.0.63 (Dec 25, 2024); Microsoft lists 2.0.63 for Windows and 2.0.62 for Server as unaffected builds; Current Windows release: V3.0.2 (Jun 27, 2026)
- **CVEs:** CVE-2025-27920
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Find every Output Messenger server and client in your estate and record its version.
2. Upgrade the server and clients to the current release; 2.0.63 is the minimum for this CVE and CVE-2025-27921.
3. Take the server off the internet and reach it only over a VPN or internal network.
4. Reset every user's password and turn on Output Messenger's two-way authentication, since the attack needs a valid login.
5. If a server ran an older build while exposed, run the checks below and rebuild it if any indicator is present.

### How to check if you are affected

- Look for OMServerService.vbs or OM.vbs in C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp on the server.
- Look for OMServerService.exe or OM.vbs in C:\Users\Public\Videos on the server and for an unexpected OMClientService.exe on clients.
- Search DNS and proxy logs for api.wordinfos[.]com, Microsoft's listed C2 domain (first seen Apr 5, 2024).
- Check for plink.exe use and for RAR archives created on user desktops, which Microsoft saw before exfiltration.

## What happened

Output Messenger is a self-hosted chat, file-sharing and VoIP tool made by Srimax. Its server holds every user's messages and files. On December 25, 2024, Srimax released 2.0.63, which its [release notes](https://www.outputmessenger.com/release-notes/) say fixes a directory traversal (CVE-2025-27920) and an XSS ([CVE-2025-27921](https://www.cve.org/CVERecord?id=CVE-2025-27921)). The [vendor advisory](https://www.outputmessenger.com/cve-2025-27920/) says `../` sequences in file paths let an attacker reach files outside the intended folder, and it credits the Microsoft Security Response Center. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-27920) was published on May 5, 2025.

On May 12, 2025, [Microsoft Threat Intelligence](https://www.microsoft.com/en-us/security/blog/2025/05/12/marbled-dust-leverages-zero-day-in-output-messenger-for-regional-espionage/) said the bug had been a zero-day. It says Marbled Dust, a "Türkiye-affiliated espionage threat actor" that overlaps with Sea Turtle and UNC1326, had used it since April 2024 against targets it links "with high confidence" to the Kurdish military in Iraq. The flaw sits in the Output Messenger Server Manager. It lets an authenticated user write files into the server's Windows startup folder. Microsoft does not know how the actor got logins in each case; it assesses that DNS hijacking or typo-squatted domains were used to capture credentials.

The actor dropped `OMServerService.vbs` in the startup folder and a Go backdoor, `OMServerService.exe`, in `Users/public/videos`. On clients it planted `OMClientService.exe`, a second backdoor that runs commands from the C2 server. Microsoft says the goal was "indiscriminate access to the communications of every user". CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27920) on May 19, 2025.

## Who is affected

Output Messenger before 2.0.63. Microsoft lists 2.0.63 for Windows and 2.0.62 for Server as the safe builds. The vendor's current Windows release is V3.0.2. The CNA scores the bug CVSS 3.1 7.2. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-27920) scores it 8.8, with low privileges required and high impact. In May 2025, [Censys](https://censys.com/advisory/cve-2025-27920/) counted 827 internet-facing instances, 620 of them apparently on vulnerable versions. The most common were far older builds such as 2.0.15 and 2.0.22.

## Do you really need to act?

Most organizations do not run this product. If you do, check it. The fix is almost two years old, but the attackers had about eight months of zero-day access first, and the Censys data shows how many servers never get updated. A chat server is a high-value target: one foothold exposes every conversation and file. Upgrading does not remove a backdoor planted earlier, so a server that was exposed before 2.0.63 needs a hunt, not just a patch.

## What to do now

1. Inventory every Output Messenger server and client, and record each version.
2. Upgrade the server and all clients to the current release. 2.0.63 is the floor.
3. Move the server behind a VPN or onto an internal-only network.
4. Reset all user passwords and turn on two-way authentication.
5. If any indicator below turns up, isolate the server, keep the evidence, rebuild it from clean media, and treat all chat history as exposed.

## How to tell if you were hit

- On the server, run `Get-ChildItem "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp" -Force` and look for `OMServerService.vbs` or `OM.vbs`.
- Run `Get-ChildItem C:\Users\Public\Videos -Force` and look for `OMServerService.exe` or `OM.vbs`. On clients, check for an `OMClientService.exe` you did not install.
- Search DNS, proxy and firewall logs for `api.wordinfos[.]com`. Microsoft also lists two VBS hashes: `1df959e4d2f48c4066fddcb5b3fd00b0b25ae44f350f5f35a86571abb2852e39` and `2b7b65d6f8815dbe18cabaa20c01be655d8475fc429388a4541eff193596ae63`.
- Look for `plink.exe` runs and RAR files on desktops, which Microsoft saw before data was sent out.

## Timeline

- Apr 5, 2024 — The Marbled Dust C2 domain is first seen. Microsoft dates exploitation to April 2024.
- Dec 25, 2024 — Srimax ships 2.0.63 with fixes for CVE-2025-27920 and CVE-2025-27921.
- May 5, 2025 — The CVE record is published.
- May 12, 2025 — Microsoft publishes its Marbled Dust report. [The Register](https://www.theregister.com/2025/05/13/turkish_spies_messaging_app/) covers it the next day.
- May 19, 2025 — CISA adds the CVE to KEV, with a June 9 deadline.

## Sources

1. [Srimax — CVE-2025-27920: Directory Traversal Vulnerability](https://www.outputmessenger.com/cve-2025-27920/)
2. [Srimax — Output Messenger release notes](https://www.outputmessenger.com/release-notes/)
3. [CVE record — CVE-2025-27920](https://www.cve.org/CVERecord?id=CVE-2025-27920)
4. [NVD — CVE-2025-27920](https://nvd.nist.gov/vuln/detail/CVE-2025-27920)
5. [CISA — Known Exploited Vulnerabilities: CVE-2025-27920](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27920)
6. [Microsoft Threat Intelligence — Marbled Dust leverages zero-day in Output Messenger for regional espionage](https://www.microsoft.com/en-us/security/blog/2025/05/12/marbled-dust-leverages-zero-day-in-output-messenger-for-regional-espionage/)
7. [CVE record — CVE-2025-27921](https://www.cve.org/CVERecord?id=CVE-2025-27921)
8. [Censys — Srimax Output Messenger directory traversal vulnerability added to CISA KEV (CVE-2025-27920)](https://censys.com/advisory/cve-2025-27920/)
9. [The Register — Türkiye-linked spy crew exploited a messaging app zero-day to snoop on Kurdish army in Iraq](https://www.theregister.com/2025/05/13/turkish_spies_messaging_app/)

---
Source page: https://erroneo.us/security/briefs/output-messenger-cve-2025-27920-directory-traversal/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt