MailEnable Enterprise Premium before 10.62 Heap Overflow via IMAP X-FB-FETCH
Affects MailEnable Enterprise Premium before 10.62 when an IMAP X-FB-USER address is longer than about 1016 bytes. Fixed in 10.62.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 10.62
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. MailEnable Enterprise Premium versions before 10.62 Attacker supplies an X-FB-USER address longer than about 1016 bytes via the IMAP X-FB-FETCH command
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 15/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
MailEnable Enterprise Premium before 10.62 contains a heap overflow vulnerability in the IMAP X-FB-FETCH command that allows authenticated users to overflow a fixed 0x400-byte heap buffer. Attackers can supply an X-FB-USER address longer than about 1016 bytes, which is formatted without a length check, to crash the IMAP service and cause denial of service.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure8/25Specific setups only, reachable over the network
- Reach?/20Unknown. No tracked technology or package matched
- Severity7.1/10CVSS 7.1
- No patch0/5No signal
What would change the score
- Would score about 65 if added to CISA KEV
- Would score about 60 if CISA's SSVC rates exploitation active
- Would score about 22 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
MailEnable Enterprise Premium versions before 10.62 Attacker supplies an X-FB-USER address longer than about 1016 bytes via the IMAP X-FB-FETCH commandUpgrade to a fixed version: 10.62.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- MailEnable MailEnable Enterprise Premium
fixed in 10.62
Evidence 2
- Link
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-125393
Is CVE-2026-125393 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
A long X-FB-USER address sent through the IMAP X-FB-FETCH command overflows a buffer in memory. The result is a crash of the IMAP service, which causes a denial of service.Source: vulncheck.com, mailenable.com
Which versions are affected by CVE-2026-125393?
MailEnable Enterprise Premium: before 10.62.Source: cve.now feed data
Am I affected, and how do I check?
Versions of MailEnable Enterprise Premium before 10.62 are affected, and the bug needs an X-FB-USER address longer than about 1016 bytes sent via X-FB-FETCH. To check your version, look at the product version shown in the MailEnable management console or installed program details.Source: vulncheck.com, mailenable.com
How do I fix CVE-2026-125393?
Upgrade MailEnable Enterprise Premium to version 10.62 or later, which contains the fix.Source: vulncheck.com, mailenable.com