ZeroDay Findings
Sign inSign up

Findings

CVE-2025-34396

MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution.

Published Dec 9, 2025 · updated Oct 14, 2026 · mailenable mailenable

MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative executable attempts to load MEAINFY.DLL from its application directo without sufficient integrity validation or secure search order. If the DLL is missing or attacker-writable locations in the search path are used, a local attacker with write permissions to the directory can plant a malicious MEAINFY.DLL. When the executable is launched, it loads the attacker-controlled library and executes code with the privileges of the process, enabling local privilege escalation when run with elevated rights.

Timeline

Detection, updates, and resolution for this record.

  1. Dec 9, 2025 · NIST NVD

    Detected

    MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative executable attempts to load MEAINFY.DLL from its application directo without sufficient integrity validation or secure search order. If the DLL is missing or attacker-writable locations in the search path are used, a local attacker with write

  2. Oct 14, 2026 · NIST NVD

    Updated

    MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative executable attempts to load MEAINFY.DLL from its application directo without sufficient integrity validation or secure search order. If the DLL is missing or attacker-writable locations in the search path are used, a local attacker with write

Affected

  • cpe mailenable/mailenableversion unspecified

Sources

  • CVE.orgCVE-2025-34396

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2025-34396

    30-day exploitation probability 0.2%

    first.org
  • NIST NVDCVE-2025-34396

    MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative executable attempts to load MEAINFY.DLL from its application directo without sufficient integrity validation or secure sea

    nvd.nist.gov

References