CVE-2025-34489: GFI MailEssentials < 21.8 Local Privilege Escalation
Published Apr 28, 2025
·Updated
GFI MailEssentials prior to version 21.8 is vulnerable to a local privilege escalation issue. A local attacker can escalate to NT Authority/SYSTEM by sending a crafted serialized payload to a .NET Remoting Service.
Affected Software
2 affected components
GFI MailEssentials<21.8
GFI MailEssentials<21.8
Event History
Apr 28, 2025
CVE Published
via MITRE·06:50 PM
Data Sourced
via MITRE·06:50 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-34489?
CVE-2025-34489 is classified as a local privilege escalation vulnerability.
2
How do I fix CVE-2025-34489?
To fix CVE-2025-34489, upgrade GFI MailEssentials to version 21.8 or later.
3
Who is affected by CVE-2025-34489?
CVE-2025-34489 affects all versions of GFI MailEssentials prior to 21.8.
4
What type of attack does CVE-2025-34489 allow?
CVE-2025-34489 allows a local attacker to escalate privileges to NT Authority/SYSTEM.
5
When was CVE-2025-34489 reported?
CVE-2025-34489 was disclosed in April 2025.