CVE-2026-103010: Heap-based Buffer Overflow in hMailServer
Heap-based buffer overflow in the legacy Blowfish decryption routine (BlowFishEncryptor::DecryptFromString) in Progressive Robot hMailServer 6.0.0 through 6.3.3 on Windows allows a local interactive user with no hMailServer credentials to write bytes of their choosing past the end of a 255-byte heap buffer in the hMailServer service process, which runs as LocalSystem by default. The user does this by passing a long hexadecimal string to the COM method Utilities.BlowfishDecrypt, which checked no authentication. The routine converted hexadecimal input of any length into a fixed 255-byte buffer before decrypting it in place. The result is a denial of service (service crash), and possibly code execution with the privileges of the service account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progressive Robot hMailServerto a version that resolves this vulnerability.Fixed in 6.3.6
Event History
Frequently Asked Questions
Who can exploit this issue?
A local interactive user on a Windows host can exploit it without hMailServer credentials. Remote-only attackers are not described as able to trigger the vulnerable COM method.
What access or input is required to trigger the overflow?
The attacker needs local access sufficient to call the Utilities.BlowfishDecrypt COM method and must provide a long hexadecimal string. The method did not perform authentication before processing the input.
What is the likely impact on a default installation?
The immediate impact is a crash of the hMailServer service. Because the service runs as LocalSystem by default, successful code execution may run with LocalSystem privileges.
Which versions need remediation?
The affected range is hMailServer 6.0.0 through 6.3.3 on Windows. Version 6.3.4 is identified by the provided release reference as the relevant updated release.