CVE-2026-103011 Progressive Robot Ltd CVE debrief

Who should care

Defenders responsible for hMailServer deployments, especially those with the self-service REST API enabled or local interactive users on Windows systems, should assess exposure and potential impacts. This includes IT administrators, security teams, and system operators who manage hMailServer installations.

Why it matters

This vulnerability in hMailServer can lead to denial of service and potentially other impacts. Defenders should verify exposure, especially in deployments with the self-service REST API enabled or local interactive user access, and prioritize remediation.

• Denial of service (service crash) can occur due to exploitation.
• Potential for other unspecified impacts exists but requires further verification.
• Verification of exposure is necessary for hMailServer deployments within the affected versions.
• Remediation priority is high for environments where the self-service REST API is enabled or where local interactive users have access.

Technical summary

The vulnerability exists in the legacy Blowfish encryption routine (BlowFishEncryptor::Encode) called by EncryptToString in hMailServer. An authenticated mailbox user can exploit this by adding a fetch account with a password of 129 to 247 characters long and not a multiple of 8, then requesting a personal data export. The routine's padding loop writes up to 7 zero bytes 2 to 232 bytes past the end of its 255-byte heap buffer.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impacts on hMailServer deployments, especially where the self-service REST API is enabled or where local interactive users have access.

Recommended defensive actions

• Verify hMailServer version and check if it is within the affected range (6.0.0 to 6.3.5).
• Assess if the self-service REST API is enabled and if there are any accounts with passwords between 129 and 247 characters long that are not multiples of 8.
• Review local interactive user access on Windows systems running hMailServer and ensure that Utilities.BlowfishEncrypt COM method access is properly restricted.
• Consider upgrading to hMailServer version 6.3.6 or later.
• Monitor for any unusual activity or service crashes that could indicate exploitation attempts.

Evidence notes

The vulnerability is confirmed in hMailServer versions 6.0.0 through 6.3.5. The self-service REST API is off by default but can be enabled, allowing remote exploitation by authenticated users with specific conditions. Local interactive users on Windows can also exploit this vulnerability through the COM method Utilities.BlowfishEncrypt without needing hMailServer credentials.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.