Local Code Execution Vulnerability in MailEnable by MailEnable

CVE-2025-34396

What is CVE-2025-34396?

MailEnable prior to version 10.54 is susceptible to an unsafe DLL loading vulnerability that can allow local attackers to execute arbitrary code. The administrative executable of MailEnable attempts to load the MEAINFY.DLL file without enforcing strict integrity checks or a secure search order. If this file is not present, or if writable directories are exploited, an attacker can introduce a malicious MEAINFY.DLL file into the application's search path. Upon execution of the administrative executable, the attacker-controlled library is loaded and executed with the privileges of the MailEnable process, potentially allowing for local privilege escalation when run with elevated permissions.

References