CVE-2026-103010 Details

A heap-based buffer overflow vulnerability has been identified in the legacy Blowfish decryption routine of Progressive Robot hMailServer versions 6.0.0 through 6.3.3 on Windows. This vulnerability allows a local interactive user without hMailServer credentials to write arbitrary bytes beyond the end of a 255-byte heap buffer in the hMailServer service process, which typically runs as LocalSystem. The issue arises when a long hexadecimal string is passed to the COM method 'Utilities.BlowfishDecrypt', which lacks authentication checks. The decryption routine converts hexadecimal input of any length into a fixed 255-byte buffer before decrypting it, leading to a denial-of-service condition by crashing the service, and potentially allowing code execution with the privileges of the service account.

Users can upgrade to hMailServer version 6.3.6, which replaces the vulnerable Blowfish implementation with a new one that does not introduce out-of-bounds writes. Instructions for upgrading are available in the release notes.