Progressive Robot hMailServer up to 6.3.3 Blowfish Decryption Routine DecryptFromString heap-based overflow

Summaryinfo

A vulnerability described as critical has been identified in Progressive Robot hMailServer up to 6.3.3. The affected element is the function BlowFishEncryptor::DecryptFromString of the component Blowfish Decryption Routine. Such manipulation leads to heap-based overflow. This vulnerability is uniquely identified as CVE-2026-103010. Local access is required to approach this attack. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Progressive Robot hMailServer up to 6.3.3. It has been rated as critical. Affected by this issue is the function BlowFishEncryptor::DecryptFromString of the component Blowfish Decryption Routine. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. CVE summarizes:

Heap-based buffer overflow in the legacy Blowfish decryption routine (BlowFishEncryptor::DecryptFromString) in Progressive Robot hMailServer 6.0.0 through 6.3.3 on Windows allows a local interactive user with no hMailServer credentials to write bytes of their choosing past the end of a 255-byte heap buffer in the hMailServer service process, which runs as LocalSystem by default. The user does this by passing a long hexadecimal string to the COM method Utilities.BlowfishDecrypt, which checked no authentication. The routine converted hexadecimal input of any length into a fixed 255-byte buffer before decrypting it in place. The result is a denial of service (service crash), and possibly code execution with the privileges of the service account.

The advisory is available at gitlab.com. This vulnerability is handled as CVE-2026-103010 since 09/29/2026. The exploitation is known to be easy. Local access is required to approach this attack. Technical details are known, but there is no available exploit.

Upgrading to version 6.3.4 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Mail Server Software

Vendor

• Progressive Robot

Name

• hMailServer

Version

• 6.3.0
• 6.3.1
• 6.3.2
• 6.3.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion