MailEnable
CVE-2025-34423
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local write access to install directory
-
DeliveryPlant malicious MEAIAU.DLL
-
ExploitAdmin executable loads DLL insecurely
-
ExecutionCode runs with process privileges
-
ImpactLocal privilege escalation / full compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V13 - Configuration Search path element control
|
| Exploitation Conditions | Exploitation requires local write access to the MailEnable installation directory so the attacker can plant a malicious MEAIAU.DLL, plus subsequent execution of the MailEnable administrative executable (ideally by a higher-privileged user) to load the DLL. Affected versions are MailEnable prior to 10.54 on Windows. Limiting factors: the attacker must already have a local foothold with directory write permissions (PR:L, AV:L), meaning secure default directory ACLs that deny write to non-administrators effectively block the attack; there is no remote or unauthenticated vector. |
| Impact | This is a local privilege/code-execution issue best characterized as a real-but-conditional risk rather than an urgent, widely-exploitable priority. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, 8.5) confirms local attack vector with low privileges required and no user interaction, yielding high confidentiality/integrity/availability impact on the vulnerable system with no scope change. All signals point to low real-world exploitation pressure: EPSS is 0.17% (5th percentile), there is no CISA KEV listing, and no public exploit code is referenced in the provided data. The high base score is driven by the triple-high impact of arbitrary code execution, but the AV:L requirement - the attacker must already have local write access to the MailEnable installation directory - sharply limits practical exploitability. No SSVC decision data was supplied. Note the 'RCE' tag overstates reach: the CVSS vector is explicitly AV:L (local), so this is local arbitrary code execution, not remote code execution. |
| Exploit ScenarioDerived | A local attacker who already has write permissions to the MailEnable installation directory (e.g., via a misconfigured directory ACL or a low-privileged service account) drops a malicious MEAIAU.DLL alongside the administrative executable. When an administrator or a higher-privileged process next launches the MailEnable admin executable, the planted DLL is loaded due to the insecure search order, executing attacker code with that process's privileges. No public proof-of-concept exploit is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Local arbitrary code execution in MailEnable Standard versions prior to 10.54 is possible because the administrative executable loads MEAIAU.DLL from its installation directory without sufficient integrity validation or a secure search order. An attacker with local write access to that directory (PR:L) can plant a malicious DLL that executes with the privileges of the process when the administrative tool is run, potentially by a higher-privileged user. The issue is not known to be actively exploited and no public exploit code has been identified; EPSS is low at 0.17% (5th percentile), and the risk is real but conditional on existing local write access, not an urgent, widely-exploitable priority.
RemediationAI
Upgrade to MailEnable Standard 10.54 or later to address the unsafe DLL loading vulnerability; the vendor-released patch is documented in the release notes at https://mailenable.com/Standard-ReleaseNotes.txt. If immediate patching is not possible, enforce strict file system permissions on the MailEnable installation directory so that only trusted administrators have write access, which blocks the planting of a malicious MEAIAU.DLL; this is the most direct compensating control but requires verifying and possibly adjusting existing ACLs, and it may affect legacy processes that rely on non-admin write access (which is uncommon for program directories). Additionally, limit execution of the MailEnable administrative executable to authorized users and monitor for unexpected MEAIAU.DLL files in the installation directory. Note that this vulnerability is local and requires an existing foothold with write access, so perimeter defenses are not relevant. The VulnCheck advisory (https://www.vulncheck.com/advisories/mailenable-dll-hijacking-via-unsafe-loading-of-meaiau-dll) provides further details.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MailEnable is a Windows mail server, and this vulnerability resides in its administrative executable's handling of the MEAIAU.DLL library. The application attempts to load MEAIAU.DLL from its installation directory without validating the DLL's integrity or enforcing a secure search order, which is a classic uncontrolled search path element (CWE-427). On Windows, the DLL search order can be hijacked if an attacker can write a malicious DLL to a directory that precedes system directories in the search path. Here, the installation directory is typically writable only by administrators, but misconfigured ACLs (or another local compromise) could allow a low-privileged attacker to plant a malicious MEAIAU.DLL. When a privileged user subsequently executes the administrative tool, the malicious DLL is loaded and executed with the tool's privileges, resulting in local arbitrary code execution. The CPE (cpe:2.3:a:mailenable:mailenable:*:*:*:*:standard:*:*:*) confirms that the Standard edition is affected. The root cause is insufficient integrity validation and an insecure library search path, aligning with CWE-427.
Know when Mailenable gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Local vector requiring prior write access to the install directory (AV:L/PR:L), low complexity, and DLL execution yields full code execution with high C/I/A and no scope change.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative executable attempts to load MEAIAU.DLL from its installation directory without sufficient integrity validation or a secure search order. A local attacker with write access to that directory can plant a malicious MEAIAU.DLL, which is then loaded on execution, resulting in attacker-controlled code running with the privileges of the process.
Executive ViewAI
MailEnable Standard versions prior to 10.54 contain a local privilege-escalation flaw that could allow an authenticated attacker with write access to the installation directory to execute code at the privilege level of the MailEnable administrative tool. This affects Windows systems running unpatched MailEnable Standard, particularly those where administrative tools are launched by higher-privileged users. Because no vendor-released patch identified at time of analysis, no public exploit identified at time of analysis, and exploitation requires existing local write access, leadership should prioritize access controls and vendor monitoring over emergency containment.
Restrict write access to the MailEnable installation directory to trusted administrators; enforce secure DLL search order and application allowlisting to block unauthorized DLL loading; run administrative tools with least privilege; monitor for unauthorized MEAIAU.DLL or file modifications; isolate affected servers if local write access cannot be controlled.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
More in Mailenable
View allXSS in MailEnable before v10 via failure.aspx. EPSS 11.5%. PoC available.
Cross-site scripting (XSS) vulnerability in ForgottenPassword.aspx in MailEnable Professional, Enterprise, and Premium 4
MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection (XXE) attacks that could be exploite
MailEnable versions prior to 10.55 contain a reflected cross-site scripting (XSS) vulnerability in the webmail interface
MailEnable versions prior to 10.55 contain a reflected cross-site scripting (XS) vulnerability in the webmail interface
MailEnable versions prior to 10.55 contain a reflected cross-site scripting (XSS) vulnerability in the webmail interface
MailEnable Enterprise Premium 10.23 did not use appropriate access control checks in a number of areas. Rated high sever
Privilege escalation via authorization bypass in MailEnable Enterprise Premium 10.55 and earlier lets a low-privileged W
Local DLL hijacking in MailEnable (mail server for Windows) lets an attacker who can write to the installation directory
DLL hijacking in MailEnable Standard versions prior to 10.54 allows local attackers with write access to the installatio
Local arbitrary code execution in MailEnable versions prior to 10.54, where the administrative executable loads MEAIAM.D
Local arbitrary code execution in MailEnable Standard editions prior to 10.54, where the MailEnable administrative execu
GitHub PoC
Exploit-DB