← Back to the live CVE advisory feed

CVE-2026-103010: hMailServer

Severity

7.8 (HIGH)

Vendor

PROGRESSIVE ROBOT LTD

Affected versions

6.0.0 through before 6.3.4

Patch status

Unknown

Published

2026-10-08T11:16:42.117

Modified

2026-10-08T11:16:42.117

Why it matters

This matters because the affected product may allow code execution. Prioritize systems that are internet-facing or have privileged access to other infrastructure.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Compare installed versions against the affected version range in the advisory.

Technical summary

Heap-based buffer overflow in the legacy Blowfish decryption routine (BlowFishEncryptor::DecryptFromString) in Progressive Robot hMailServer 6.0.0 through 6.3.3 on Windows allows a local interactive user with no hMailServer credentials to write bytes of their choosing past the end of a 255-byte heap buffer in the hMailServer service process, which runs as LocalSystem by default. The user does this by passing a long hexadecimal string to the COM method Utilities.BlowfishDecrypt, which checked no authentication. The routine converted hexadecimal input of any length into a fixed 255-byte buffer before decrypting it in place. The result is a denial of service (service crash), and possibly code execution with the privileges of the service account.

View the official NVD record for CVE-2026-103010

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.