MailEnable CVE-2025-34420

Exploitation requires LOCAL access to the Windows host and, critically, write permission to the MailEnable installation directory so the attacker can plant a malicious MEAIAM.DLL that the administrative executable loads due to an insecure DLL search order and missing integrity validation. It further requires that the MailEnable administrative executable is subsequently run (by an operator or the service) to trigger the load. Limiting factors: this is not remotely reachable (AV:L), it depends on the install directory being writable by the attacker (which secure default ACLs on a protected program directory would normally prevent), and resulting privileges are bounded by the privileges of the process that loads the DLL. Affected only on versions prior to 10.54.

This is a CWE-427 DLL hijacking / unsafe library loading flaw in MailEnable prior to 10.54. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, score 8.5) is internally consistent with the description: exploitation is LOCAL (AV:L), requires some existing privilege (PR:L) - specifically write access to the MailEnable installation directory - and yields full confidentiality, integrity, and availability impact once the planted MEAIAM.DLL is loaded. These signals agree with each other, but they describe a post-access privilege/persistence primitive, not a remotely reachable RCE. The real-world exploitation signals are weak: EPSS is only 0.17% (6th percentile), there is no CISA KEV listing, and no public exploit code is referenced - so this is no public exploit identified at time of analysis. Net assessment: despite the 'HIGH/8.5' headline, the LOCAL attack vector plus the precondition of pre-existing write access to a protected program directory make this a lower real-world priority than a network RCE of comparable score. It matters most as a local privilege-escalation / code-execution-as-the-mail-service vector where an attacker (or a low-privileged service account) can already write to the install path. Note the 'RCE' tag overstates the reachability: the CVSS explicitly marks this local (AV:L), so it is local arbitrary code execution, not remote.

A low-privileged user or a compromised account on a Windows host running MailEnable (where the installation directory is writable, e.g. loose ACLs or non-default install location) drops a malicious MEAIAM.DLL into the MailEnable program folder. When an administrator or the service next runs the MailEnable administrative executable, the planted DLL is loaded due to the insecure search order, executing attacker code with that process's privileges. No public proof-of-concept is referenced for this specific CVE.