CVE-2026-103010

Summary

A heap-based buffer overflow exists in Progressive Robot hMailServer's legacy Blowfish decryption routine that allows a local user to write beyond a 255-byte heap buffer, potentially leading to service crashes or code execution with LocalSystem privileges.

Exploitability

Exploitation is moderately difficult as it requires a local interactive user to pass a long hexadecimal string to the unauthenticated COM method Utilities.BlowfishDecrypt, but the vulnerability is remotely exploitable through local access and could be chained with other local privilege escalation techniques.

Blast radius

The impact is significant since the hMailServer service runs as LocalSystem by default, meaning successful exploitation could lead to full system compromise with elevated privileges.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to hMailServer version 6.4.0 or later to address this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.