CVE-2026-103010 Progressive Robot Ltd CVE debrief

Who should care

Defenders responsible for Windows systems with hMailServer installed should assess exposure and apply remediation to prevent potential code execution with elevated privileges. This includes verifying the hMailServer version, restricting access to the hMailServer service process, and monitoring for suspicious activity. Additionally, defenders should review compensating controls for exposed systems while remediation is scheduled and verified, and track

Why it matters

A local interactive user with no hMailServer credentials can exploit this vulnerability to potentially cause a denial of service and execute code with elevated privileges, requiring defenders to verify exposure and apply remediation.

• Potential denial of service (service crash)
• Possible code execution with LocalSystem privileges
• Verification of hMailServer version and patch level required
• Restrictive access controls to the hMailServer service process recommended

Technical summary

The vulnerability exists in the legacy Blowfish decryption routine (BlowFishEncryptor::DecryptFromString) in Progressive Robot hMailServer 6.0.0 through 6.3.3 on Windows. A local interactive user with no hMailServer credentials can write bytes of their choosing past the end of a 255-byte heap buffer in the hMailServer service process by passing a long hexadecimal string to the COM method Utilities.BlowfishDecrypt.

Defensive priority

Defenders should prioritize verifying exposure and applying remediation, as the vulnerability allows for potential code execution with elevated privileges.

Recommended defensive actions

• Verify hMailServer version and apply patch 6.3.4 if vulnerable
• Restrict access to the hMailServer service process
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by a heap-based buffer overflow in the Blowfish decryption routine. The affected versions are 6.0.0 through 6.3.3, and the vulnerability was fixed in version 6.3.4. This issue allows a local interactive user with no hMailServer credentials to write bytes of their choosing past the end of a 255-byte heap buffer in the hMailServer service process, which runs as LocalSystem by default, by passing a long hexadecimal string to the COM method Utilities.BlowfishDecrypt. The routine converted hexadecimal input of

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.