PT-2025-50135 · Mailenable · Mailenable

Mushroomsecteam · Published 2025-12-09 · Updated 2025-12-10 · CVE-2025-34396

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MailEnable versions prior to 10.54

Description MailEnable versions prior to 10.54 have an unsafe DLL loading issue that could allow a local attacker to execute arbitrary code. The MailEnable administrative executable attempts to load MEAINFY.DLL from its application directory without proper validation. If the DLL is missing or an attacker can write to locations in the search path, they can place a malicious MEAINFY.DLL. When the executable is run, it loads the attacker-controlled library and executes code with the process's privileges, potentially leading to local privilege escalation if the process is running with elevated rights.

Recommendations Update MailEnable to version 10.54 or later.

Fix

LPE

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2025-34396

Affected Products

Mailenable

References · 6

• https://mailenable.com/Standard-ReleaseNotes.txt · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-34396 · Security Note
• https://osv.dev/vulnerability/CVE-2025-34396 · Vendor Advisory
• https://twitter.com/CVEnew/status/1998732836883632546 · Twitter Post
• https://vulncheck.com/advisories/mailenable-dll-hijacking-via-unsafe-loading-of-meainfy-dll · Note
• https://mailenable.com · Note