Vulnerability · Published Oct 8, 2026 · Assigned by GitLab
CVE-2026-103010Heap-based Buffer Overflow in hMailServer
High 7.8
In plain English
A high-severity heap buffer overflow in hMailServer from Progressive Robot Ltd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).
Official description
Heap-based buffer overflow in the legacy Blowfish decryption routine (BlowFishEncryptor::DecryptFromString) in Progressive Robot hMailServer 6.0.0 through 6.3.3 on Windows allows a local interactive user with no hMailServer credentials to write bytes of their choosing past the end of a 255-byte heap buffer in the hMailServer service process, which runs as LocalSystem by default. The user does this by passing a long hexadecimal string to the COM method Utilities.BlowfishDecrypt, which checked no authentication. The routine converted hexadecimal input of any length into a fixed 255-byte buffer before decrypting it in place. The result is a denial of service (service crash), and possibly code execution with the privileges of the service account.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Progressive Robot Ltd | hMailServer | 6.0.0 – before 6.3.4 |
Weakness: CWE-122 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H