{"id":"CVE-2026-103010","summary":"Heap-based Buffer Overflow in hMailServer","details":"Heap-based buffer overflow in the legacy Blowfish decryption routine (BlowFishEncryptor::DecryptFromString) in Progressive Robot hMailServer 6.0.0 through 6.3.3 on Windows allows a local interactive user with no hMailServer credentials to write bytes of their choosing past the end of a 255-byte heap buffer in the hMailServer service process, which runs as LocalSystem by default. The user does this by passing a long hexadecimal string to the COM method Utilities.BlowfishDecrypt, which checked no authentication. The routine converted hexadecimal input of any length into a fixed 255-byte buffer before decrypting it in place. The result is a denial of service (service crash), and possibly code execution with the privileges of the service account.","modified":"2026-10-10T07:07:00.570398181Z","published":"2026-10-08T10:53:10.627Z","database_specific":{"cwe_ids":["CWE-122"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103010.json","cna_assigner":"GitLab"},"references":[{"type":"WEB","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.4"},{"type":"WEB","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/49"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103010.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103010"},{"type":"FIX","url":"https://gitlab.com/hmailserver/hmailserver/-/commit/135a1908ff820ed587d5f180f98c53bd010d8931"},{"type":"PACKAGE","url":"https://gitlab.com/hmailserver/hmailserver"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://gitlab.com/hmailserver/hmailserver","events":[{"introduced":"e4b7163189ac6ce365bb954cf3e264e2e3105a18"},{"fixed":"51e2dbda08d6aa7fcda5a48f1af05221809f78be"}],"database_specific":{"extracted_events":[{"introduced":"6.0.0"},{"fixed":"6.3.4"}],"source":"AFFECTED_FIELD"}}],"versions":["v6.3.3","v6.3.2","build-inputs-1","v6.3.1","v6.3.0","v6.2.28","v6.2.27","v6.2.26","v6.2.25","v6.2.24","v6.2.23-alpha2","v6.2.23-alpha1","v6.2.22-pre6","v6.2.22-pre5","v6.2.22-pre4","v6.2.22-pre3","v6.2.22-pre2","v6.2.22-pre1","v6.2.21","v6.2.20","v6.2.19","v6.2.18","v6.2.17","v6.2.16","v6.2.15","v6.2.14","v6.2.13","v6.2.12","v6.2.11","v6.2.10","v6.2.9","v6.2.8","v6.2.7","v6.2.6","v6.2.5","v6.2.4","v6.2.3","v6.2.2","v6.2.1","v6.2.0","v6.1.0","v6.0.0-B4","v6.0.0-B3","v6.0.0"],"database_specific":{"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be","target":{"file":"hmailserver/source/Server/Common/Util/OpenPgpKey.cpp"},"deprecated":false,"digest":{"line_hashes":["173026644744428468122178710305458733610","72023418976949700636706848348170513083","221755301875929245221851728560244100688","86015716840889777238664922845986602568"],"threshold":0.9},"id":"CVE-2026-103010-03cbf0d8"},{"digest":{"length":973,"function_hash":"221298502580959622673081158792108986591"},"id":"CVE-2026-103010-160ac7e9","signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be","target":{"function":"BrandLogo::Known","file":"hmailserver/source/Server/Common/Util/BrandLogo.cpp"},"deprecated":false},{"source":"https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be","target":{"file":"hmailserver/source/Server/Common/AntiSpam/DMARC/DMARC.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["144971333099417583677465868090583294341","31159591477287234542554676120105802797","187316242465413148142487768211424648896"]},"id":"CVE-2026-103010-25acf673","signature_type":"Line","signature_version":"v1"},{"target":{"function":"BrandLogoTester::Test","file":"hmailserver/source/Server/Common/Util/BrandLogo.cpp"},"deprecated":false,"digest":{"function_hash":"186398542115389452270982473998957878288","length":5043},"id":"CVE-2026-103010-2ade12be","signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["168436356617409950203061960813192391513","6794219631689290374375489382766084136","252982190880083623206279529070075974574","299040040893001406502522247329002866547","287776739933185647292506548609677251186","231079773074675756992636741122816628595","202456874104008953527166003454093353990","280163632586104781557342952693406806439","331526745349849731646393559398602458790","243494023290129129247647142079354925171","136050685234224721948291361893832728254","31933306883685020205990209721312268021","121118874047973560113727775030293053838","150404206715707704019842938531875526158","321727766633300175530979160633919537387","135856718981026289583584401003473709918","134844127943263121532631510593039974225","272110326339456724343688205065594121499","51853996588338471719564324329830795455","79537457975022156230197554773554757390","159047340350530216060843677576605554244","11054909884212234558068204007937845336","138198898639824643694516625013774586703","234224701433770972670466770643766770767","301397185273431833290693057306824921022","172773720504601780971733192650514012601","298420838722684324919004038955221678482","112713433705879362159734459973400990002","58725824035969435507292074060043744404","187155979713494877424140503413922900249","43562112869163724717121068670467317579","186181325023914072765685820336622063621","36162853698317664990001524707683579454","130160835077689870641305337167501541080","172303239323519771248590415933409487693","263003904147061727736075762846303040636","328623339914416941917653308980437055009","93184631329294095492664046036972427577","238612367967960963215902181164545442400","130542493997154179637231108077803085067","56551016899255927073418015047294135406","4140569880360836934746170614674767758"]},"id":"CVE-2026-103010-3bfe3d58","signature_type":"Line","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be","target":{"file":"hmailserver/source/Server/Common/Util/BrandLogo.cpp"}},{"target":{"file":"hmailserver/source/Server/Common/AntiSpam/DMARC/DMARC.cpp","function":"DMARC::GetOrganizationalDomain"},"deprecated":false,"digest":{"length":1491,"function_hash":"278807372347695046392379528524658391690"},"id":"CVE-2026-103010-540d43f2","signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be"},{"source":"https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be","target":{"function":"BrandLogo::Lookup","file":"hmailserver/source/Server/Common/Util/BrandLogo.cpp"},"deprecated":false,"digest":{"function_hash":"101049009052070862673143003378209265536","length":2529},"id":"CVE-2026-103010-600a17a1","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be","target":{"file":"hmailserver/source/Server/Common/Util/OpenPgpRing.cpp","function":"OrganizationOf"},"deprecated":false,"digest":{"function_hash":"201216107189199025747155831459028417972","length":291},"id":"CVE-2026-103010-685fb01d","signature_type":"Function"},{"target":{"file":"hmailserver/source/Server/Common/Util/BrandLogo.cpp","function":"BrandLogo::NoteUnreachable"},"deprecated":false,"digest":{"length":355,"function_hash":"123310048572992211037007553603146831106"},"id":"CVE-2026-103010-7ad95dc8","signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be"},{"digest":{"line_hashes":["217382572294579024735186115350336824679","232644099280258314673252833632276642099","110569033486641569700537356008436665845","84119630109514399254486181244345713130","259019608430282499671422980499421477618","52087883268710942835635511936791275282","179030710271600826080624829516933781491","224199370542123069802823027860631327891","200353981174873361365807128097563402385","316390505624589695144811903274316766118","133089887383778879198519001979618554720","54950605529578730242318991905163910731","265855952655961837495456519263390755392","230353888280009246803103428288728273728","76779441353424855381469476030476787557","79012237758407394652907649643996776792","25522713397161463026179222506230686611","64126595560494705544673621272880779613","211058975816949608175577181041279670458","29800085896162780145646767332964607418","301730279402659834591514492834334066072","186630290065603701434527332358208467213","25638580773822852539937310495465095447","259915868232482277532496485102897914632","82250017844024707338911690750149863928","174084133835922313078379776494829066329","2065155735359526455960829967888112969","160514846154226678461703270474070596984","43989780037341512358409362985998826467","284473009188797321148608657203341343862","118098243344204889721369539689993235560","283309733487295571326145247622519034222","331614447821169766920274085995693130986","176657794663911736929009410982039958967","223379499072880358704029102742648425174","336558161408354835180887745069676588330","176679858706659811817064273985023338676","60358499010207033038067530593022014384","274151641384423890508517136232117386476"],"threshold":0.9},"id":"CVE-2026-103010-b3897b18","signature_type":"Line","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be","target":{"file":"hmailserver/source/Server/Common/Util/HelpPagesData.cpp"},"deprecated":false},{"digest":{"function_hash":"203823155983048518933070330295708678424","length":393},"id":"CVE-2026-103010-b73bf924","signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be","target":{"file":"hmailserver/source/Server/Common/Util/BrandLogo.cpp","function":"BrandLogo::OrganizationUnreachable"},"deprecated":false},{"source":"https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be","target":{"file":"hmailserver/source/Server/Common/Util/OpenPgpRing.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["13305429830417078381577849579222307952","200963078023762552825019393750614922818","253563660183400374534982320389126141836","234216325056108639265321213186242383847","323502006306225203958453684764698789172","330608554865418440534524197738713451695"]},"id":"CVE-2026-103010-b83b53f7","signature_type":"Line","signature_version":"v1"},{"source":"https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be","target":{"file":"hmailserver/source/Server/Common/Util/OpenPgpRing.cpp"},"deprecated":false,"digest":{"line_hashes":["152299132225481955129083943650846430355","6832375023684051416024853616361073248","17286084956157793008968093056903433243","333926647583753214205894131391698095821","182954244113595280749716391894917881052","10858688535906719378376534038702630206","49245178924821749663418407928741492277","198449475183301911312041086383448532849","245747971491445848035082446334526738410","278093215453296294471553309692391210011","22720539698454247105318459248710942846","260309424996080693003755716393366232174","297613183086039466654188872362741305411","83957724610820370361630691803768850830","26495453224653257279366685044481481565","189709503675348466167373995380834859094","10978199679427179090966753870859204368","9154682085417310374767006515767487313","19881229781620602186308276457337437711","324572266610113110387869397512302309116","109922435036688171536546886352730029414","333601900956653395105293064694531168428","238793520418025444556797171875566900645","16155061912276528935849030281324998088","177320160773423319251042524889336844238","73058796500149874001442693826784133305","27018090392347864312123848083753264713","201927254980614350098587277271123287661","303686298033920729976632668539186359104","156433723844260406884997666237948756309","138894064220673407651725242671189798819","125019865211290587116655878065852377973","230824176478718862520099157531290681061","38686542358223295083678148303309426063","270472538301331821370673936795850477138","49836890341310462912134001365840850705","63479588901760399606865205982032770922","163341128980479675061617121035740813469","340167185421461139211499616584089667658","28548489704343060949689971804232349899","5395620120301560644686979954111996102","280224792796370955696431520193322369242","216115057690403493105938423696936861935","293786890815987531955079945967820543629","320761796262881018007117505877699757993","5857276131175026203138028776326389310","135767860110261933709455295171715619804"],"threshold":0.9},"id":"CVE-2026-103010-be0bf4aa","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be","target":{"file":"hmailserver/source/Server/Common/Util/OpenPgpKey.cpp","function":"OpenPgpKeyTester::Test"},"deprecated":false,"digest":{"function_hash":"16789147279579673751328946408595684874","length":12845},"id":"CVE-2026-103010-d8c252b2","signature_type":"Function"},{"id":"CVE-2026-103010-dbadab72","signature_type":"Line","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be","target":{"file":"hmailserver/source/Server/Common/AntiSpam/DMARC/DMARC.h"},"deprecated":false,"digest":{"line_hashes":["149908044363547641126729805970713464697","134579754139239445225456843238923825694","55952527745130178710956086528791140696","119590332145380478806719950532080953389","24012987281392793160008181792258729292","238841215959507221196200319264240349921"],"threshold":0.9}},{"target":{"file":"hmailserver/source/Server/Common/Util/OpenPgpRing.cpp","function":"OpenPgpRing::Lookup"},"deprecated":false,"digest":{"length":3573,"function_hash":"292573371798982288366075326854979257954"},"id":"CVE-2026-103010-e15fb309","signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be"}],"vanir_signatures_modified":"2026-10-10T07:07:00Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103010.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}