CVE-2026-103011: CWE-122: Heap-based Buffer Overflow in Progressive Robot Ltd hMailServer

The vulnerability exists in the BlowFishEncryptor::Encode function used by hMailServer's legacy Blowfish encryption routine. When encrypting passwords between 129 and 247 characters long that are not multiples of 8, the padding loop writes up to 7 zero bytes beyond the end of a 255-byte heap buffer, causing a heap-based buffer overflow. This can be triggered remotely via the self-service REST API (enabled by default only in versions 6.3.4 and 6.3.5) by an authenticated mailbox user requesting a personal data export. On Windows, any local interactive user can exploit the flaw through the COM method Utilities.BlowfishEncrypt without authentication. The vulnerability also affects stored-secret writes when ProtectStoredSecretsWithDPAPI is disabled. The overflow may cause denial of service (service crash) but the ciphertext output remains correct.

The primary impact is denial of service due to service crashes triggered by heap-based buffer overflow. There is no reported impact on confidentiality or integrity. The vulnerability requires authenticated mailbox access for remote exploitation via the REST API, or local interactive user access on Windows without authentication for the COM method. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the self-service REST API and disable or restrict use of the COM method Utilities.BlowfishEncrypt. Additionally, ensure ProtectStoredSecretsWithDPAPI is enabled (set to 1) to prevent exploitation via stored-secret writes. Monitor vendor communications for patches or official fixes.