CVE-2026-103010: CWE-122: Heap-based Buffer Overflow in Progressive Robot Ltd hMailServer
Description
Heap-based buffer overflow in the legacy Blowfish decryption routine (BlowFishEncryptor::DecryptFromString) in Progressive Robot hMailServer 6.0.0 through 6.3.3 on Windows allows a local interactive user with no hMailServer credentials to write bytes of their choosing past the end of a 255-byte heap buffer in the hMailServer service process, which runs as LocalSystem by default. The user does this by passing a long hexadecimal string to the COM method Utilities.BlowfishDecrypt, which checked no authentication. The routine converted hexadecimal input of any length into a fixed 255-byte buffer before decrypting it in place. The result is a denial of service (service crash), and possibly code execution with the privileges of the service account.
CVSS v3.1
Score 7.8high
Affected software
Progressive Robot Ltd
hMailServer
pkg:github/hmailserver/hmailserverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-103010 is a heap-based buffer overflow in the BlowfishDecrypt method of the Utilities COM interface in hMailServer versions 6.0.0 through 6.3.3. The vulnerability arises because the method accepts a hexadecimal string of arbitrary length, converts it into a fixed 255-byte buffer, and decrypts it in place without proper bounds checking. Since the COM method does not require authentication, a local user can exploit this to overwrite memory beyond the buffer, potentially causing a crash or arbitrary code execution with LocalSystem privileges.
Potential Impact
Successful exploitation can lead to a denial of service by crashing the hMailServer service or potentially allow arbitrary code execution with LocalSystem privileges. This elevates a local user's privileges and compromises the security of the affected system.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and consider disabling or restricting access to the Utilities.BlowfishDecrypt COM method if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitLab
- Date Reserved
- 2026-09-29T21:04:45.349Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac778a32cdf04f6560ccf4d
Added to database: 10/08/2026, 11:04:03 UTC
Last enriched: 10/08/2026, 11:18:47 UTC
Last updated: 10/08/2026, 15:04:12 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.