MailEnable CVE-2025-34419

Exploitation requires the attacker to already have LOCAL write access to the MailEnable installation directory (where MEAISM.DLL is loaded from) - this is the exact, concrete prerequisite. The malicious DLL only executes when the MailEnable administrative executable is subsequently started, so a second trigger (typically an administrator running the admin tool) is needed, and the code runs with that process's privileges rather than automatically escalating. Limiting factors: no network reachability (local-only), a pre-existing foothold with directory write permission is required, and default installations with correctly restricted ACLs on the install directory would prevent the DLL plant. There is no remote or unauthenticated path.

This is a locally-exploitable DLL hijacking flaw (CWE-427) in MailEnable prior to 10.54, and the available signals consistently point to moderate rather than urgent real-world risk. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H/VA:H, score 8.5) confirms the attack is LOCAL and requires some level of privilege (PR:L) - specifically write access to the MailEnable installation directory - so this is not a remotely-reachable, unauthenticated threat despite the high base score. EPSS reinforces low near-term exploitation likelihood at 0.17% (6th percentile), and the vulnerability is NOT listed in CISA KEV and has no public exploit identified, so there is no evidence of active exploitation. No SSVC decision data was provided. The signals are internally consistent (local vector + low EPSS + no KEV + high technical impact), so there is no contradiction to flag; the high CVSS is driven purely by the full compromise of confidentiality/integrity/availability once the condition is met, not by ease of reach. Net: a genuine privilege-escalation/code-execution risk on already-compromised or loosely-ACL'd hosts, but a low priority relative to network-reachable critical flaws. The AV:L vector is consistent with the description's explicit 'local attacker' framing, so no vendor verification of attack vector is needed.

A low-privileged user (or an attacker who has already gained a foothold) with write permission to the MailEnable installation directory plants a malicious MEAISM.DLL in that folder. When an administrator later launches the MailEnable administrative executable, the planted DLL is loaded due to insufficient integrity validation and insecure search order, executing attacker-controlled code with the privileges of that process. No public exploit code has been identified at time of analysis.