hMailServer CVE-2026-107571

Exploitation requires BOTH: (1) a local, authenticated non-administrator account on the host, and (2) hMailServer installed to a non-default location whose permissions are inherited from a writable parent - specifically the root of an NTFS drive, where Authenticated Users receive Modify (Windows client) or Users receive create-files/folders rights (Windows Server) over the program folder and Bin. The default Program Files installation is explicitly NOT affected because ordinary users receive only read/execute there. The concrete attack primitives are: replacing the service program (runs as LocalSystem or the service virtual account), replacing programs an administrator later runs elevated from Bin, or planting a DLL in Bin that those programs load in place of the system copy. Limiting factors: no remote vector (local access needed), prior authentication required, and dependence on an administrator having chosen the insecure install path - the vulnerability does not exist under the default, recommended configuration.

This is a genuine but conditional local privilege-escalation issue (CWE-276, incorrect default permissions), not a remotely wormable threat. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 HIGH) is internally consistent with the description: exploitation requires a local, already-authenticated low-privilege user (PR:L), and the high C/I/A impact reflects code execution as LocalSystem or the service virtual account. No EPSS score, KEV listing, SSVC decision, or POC is present in the input - exploitation status is therefore 'no public exploit identified at time of analysis', and there is no evidence of active exploitation. The single most important risk-reducing factor is that the default Program Files installation is NOT affected; the flaw only manifests when an administrator installs the product to a writable location such as the root of an NTFS drive, where Authenticated Users (client) or Users (server) inherit write access to Bin. This makes real-world risk strongly dependent on local deployment choices rather than a universal condition. Net assessment: a real, patch-worthy local EoC/EoP issue for environments with non-standard install paths, but not a drop-everything priority absent confirmation that affected hosts use a root/writable install location. The 7.8 score somewhat overstates practical exposure because it does not encode the non-default-path precondition.

An administrator installs hMailServer 6.0.0-6.3.6 to a non-default path such as C:\hMailServer (the root of a drive), where the Bin folder inherits write permissions for Authenticated Users or Users. A local non-administrator user replaces the service executable or drops a malicious DLL into Bin; when the LocalSystem/virtual-account service (re)starts, or when an admin runs an elevated maintenance tool from Bin, the attacker's code executes with high privileges. No public proof-of-concept is identified in the provided data.