CVE-2026-103011 Heap-based Buffer Overflow in hMailServer
Authenticated users or local attackers can trigger a heap buffer overflow in hMailServer's legacy encryption, causing crashes or potential code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-103011?
CVE-2026-103011 is a medium-severity memory corruption vulnerability in Progressive Robot Ltd hMailServer, published on 8 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Heap-based buffer overflow in the legacy Blowfish encryption routine (BlowFishEncryptor::Encode, called by EncryptToString) in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows an authenticated mailbox user to cause a denial of service (service crash), and possibly other unspecified impact. In 6.3.4 and 6.3.5, where the self-service REST API is enabled (it is off by default), the user does this remotely by adding a fetch account whose password is 129 to 247 characters long and not a multiple of 8, and then requesting their personal data export (GET /api/v1/me/export.zip), which encrypts that password with the legacy scheme. The same flaw is reachable on Windows by any local interactive user with no hMailServer credentials, through the COM method Utilities.BlowfishEncrypt, which checked no authentication. It is also reachable by every stored-secret write when ProtectStoredSecretsWithDPAPI is set to 0. For such a length, the routine's padding loop writes up to 7 zero bytes 2 to 232 bytes past the end of its 255-byte heap buffer. The ciphertext it returns is still correct.
Weakness: CWE-122
Which versions are affected by CVE-2026-103011?
How do I fix CVE-2026-103011?
No fix has been published for CVE-2026-103011 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-103011 being exploited?
There is no known exploitation of CVE-2026-103011 in the wild and no public exploit code.
Sources
Also known as GHSA-46vr-9694-qxgc.