CVE-2025-34423CWE-427

CVE-2025-34423

High · published December 10, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
5.8
In the wild
Unconfirmed
What it is

⚡ An unguarded door in MailEnable could let a local attacker execute arbitrary code with just a sneaky DLL drop! 🔥 Think of a restaurant kitchen: if a rogue chef could swap out the spice jar with a poisonous blend, every dish they prepare could become a health hazard. In this case, the vulnerable MEAIAU.DLL is the spice jar that lets attackers cook up malicious code right from the installation directory. This vulnerability allows an attacker who has write access to load malicious code into the MailEnable process, potentially leading to disastrous outcomes like data theft, system compromise, or unauthorized access to sensitive configurations. It's a dangerous scenario where one wrong ingredient could spoil the entire kitchen!

Put simply

Think of a restaurant kitchen: if a rogue chef could swap out the spice jar with a poisonous blend, every dish they prepare could become a health hazard. In this case, the vulnerable MEAIAU.DLL is the spice jar that lets attackers cook up malicious code right from the installation directory. MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability, where the administrative executable loads MEAIAU.DLL without sufficient integrity checks. This allows local attackers to execute arbitrary code with the process's privileges by placing a malicious DLL in the installation directory.

What to do

This vulnerability allows an attacker who has write access to load malicious code into the MailEnable process, potentially leading to disastrous outcomes like data theft, system compromise, or unauthorized access to sensitive configurations. It's a dangerous scenario where one wrong ingredient could spoil the entire kitchen! Upgrade MailEnable to version 10.54 or later immediately to close this security gap. Additionally, review directory permissions to restrict write access to trusted users only, ensuring that unauthorized users can't plant malicious files. You’ve got this! By taking these steps, you’ll lock down your MailEnable installation and keep those sneaky attackers at bay! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00168 · 5.8th percentile
Weakness
CWE-427 · Uncontrolled Search Path Element
Published
2025-12-10T21:16Z
Affected products (1)
ProductVersionsFixed in
mailenable/mailenable< 10.5410.54
References (3)
EPSS history
Timeline
  • 10 DEC 16:07Z
    MailEnable < 10.54 DLL Hijacking via Unsafe Loading of MEAIAU.DLL
    cvelistv5