PT-2025-50342 · Mailenable · Mailenable

Mushroomsecteam · Published 2025-12-10 · Updated 2025-12-14 · CVE-2025-34418

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MailEnable versions prior to 10.54

Description MailEnable versions prior to 10.54 have an unsafe DLL loading issue that could allow a local attacker to execute arbitrary code. The MailEnable administrative executable loads MEAIMF.DLL from the installation directory without proper validation. An attacker with write access to this directory can place a malicious MEAIMF.DLL file, which will then be executed when the application starts, granting the attacker the privileges of the process.

Recommendations Update MailEnable to version 10.54 or later.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2025-34418

Affected Products

Mailenable

References · 7

• https://osv.dev/vulnerability/CVE-2025-34418 · Vendor Advisory
• https://mailenable.com/Standard-ReleaseNotes.txt · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-34418 · Security Note
• https://t.me/CVEtracker/39367 · Telegram Post
• https://vulncheck.com/advisories/mailenable-dll-hijacking-via-unsafe-loading-of-meaimf-dll · Note
• https://mailenable.com · Note
• https://twitter.com/CVEnew/status/2000248636421398801 · Twitter Post