CVE-2026-126625: hMailServer Windows installer privilege escalation via insecure folder permissions

CVE-2026-126625 · Severity: medium · CVSS 6.7 · Published 2026-11-11

hMailServer is a Windows mail server that manages email delivery and storage. When installed to a writable location such as a drive root rather than the default Program Files folder, the installer briefly creates a program directory with overly permissive default access controls. An attacker with any local user account can exploit this race condition to inject malicious code into system binaries, gaining execution with the service's privileges (often LocalSystem/administrator level) when the service starts or administrators run maintenance tools.

Technologies: Progressive Robot hMailServer. Vendors: Progressive Robot.

Quick answers

Is CVE-2026-126625 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-126625 being exploited in the wild.
How severe is CVE-2026-126625?
Medium severity, with a CVSS score of 6.7, published 11 November 2026.
Which products and versions are affected?
Progressive Robot hMailServer 6.0.0 through 6.3.6.
Is there a fix for CVE-2026-126625?
Yes: fixed in 6.3.8. Until then: Install hMailServer to its default location under Program Files, or to any directory whose parent folder restricts write access to administrators and SYSTEM only. Do not install to a drive root or other location that inherits broad write permissions from parent folders. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126625 attacked?
It is attacked with local access.
Am I affected by CVE-2026-126625?
Check whether you run Progressive Robot hMailServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 6.3.8

Install hMailServer to its default location under Program Files, or to any directory whose parent folder restricts write access to administrators and SYSTEM only. Do not install to a drive root or other location that inherits broad write permissions from parent folders.

Technical details

The vulnerability is a race condition in the Inno Setup installer combined with insecure default NTFS permission inheritance. When installing to a location whose parent folder grants write access to unprivileged users (e.g., drive root), the installer creates the program and Bin folders with inherited permissions before hardening them 33–139 milliseconds later. During this window, any local user can create files and subdirectories that retain their ownership, including a malicious Bin folder. Setup then executes programs from Bin with elevated privileges and registers the service without first validating folder ownership, allowing DLL hijacking through libraries placed in Bin. The default installation under Program Files is unaffected because that location grants ordinary users only read and execute rights.

Affected products

  • Progressive Robot hMailServer 6.0.0 through 6.3.6

Timeline

  • 2026-11-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.