Heap-based Buffer Overflow in Progressive Robot hMailServer
CVE-2026-103010

7.8HIGH

Key Information:

Vendor

Progressive Robot Ltd

Status
Hmailserver
Vendor
CVE Published:
8 October 2026

What is CVE-2026-103010?

A security flaw exists in the legacy Blowfish decryption routine of hMailServer, allowing a local user to exploit a heap-based buffer overflow. This occurs when a user passes excessively long hexadecimal strings to the Utilities.BlowfishDecrypt method, which lacks proper authentication checks. As a result, the service can crash, leading to potential unauthorized code execution with system-level privileges. The vulnerability is present in versions 6.0.0 through 6.3.3 of hMailServer for Windows.

Affected Version(s)

hMailServer 6.0.0 < 6.3.4

References

https://gitlab.com/hmailserver/hmailserver/-/commit/135a1...
https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.4
https://gitlab.com/hmailserver/hmailserver/-/work_items/49

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Found in the hMailServer project's own code review (Progressive Robot Ltd)
.