PT-2025-50340 · Mailenable · Mailenable

Mushroomsecteam · Published 2025-12-10 · Updated 2025-12-14 · CVE-2025-34416

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MailEnable versions prior to 10.54

Description MailEnable versions prior to 10.54 have an issue where an unsafe Dynamic Link Library (DLL) loading process can allow a local attacker to execute arbitrary code. The MailEnable administrative executable loads MEAIPO.DLL from the installation directory without proper validation. An attacker with write access to this directory can place a malicious MEAIPO.DLL file, which will then be executed when the administrative executable starts, granting the attacker the privileges of the process.

Recommendations Update MailEnable to version 10.54 or later.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2025-34416

Affected Products

Mailenable

References · 7

• https://osv.dev/vulnerability/CVE-2025-34416 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34416 · Security Note
• https://mailenable.com/Standard-ReleaseNotes.txt · Patch
• https://twitter.com/CVEnew/status/2000248634059972893 · Twitter Post
• https://t.me/CVEtracker/39365 · Telegram Post
• https://mailenable.com · Note
• https://vulncheck.com/advisories/mailenable-dll-hijacking-via-unsafe-loading-of-meaipo-dll · Note