CVE-2026-125393 · Vendor
NO FIX YET · SEE WHAT TO DO
MailEnable Enterprise Premium before 10.62 has a heap overflow in the IMAP X-FB-FETCH command, where an oversized X-FB-USER address is written past a fixed 0x400-byte buffer. An authenticated user can crash the IMAP service, causing denial of service.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organisations running MailEnable Enterprise Premium with the IMAP service enabled, where users have valid mailbox credentials. The sources do not say whether other MailEnable editions are affected.
Not affected if auth-required, non-premium-edition
Who cares imap, mailenable, self-hosted, windows
10.62 or later.MailEnable Enterprise Premium before 10.62 contains a heap overflow vulnerability in the IMAP X-FB-FETCH command that allows authenticated users to overflow a fixed 0x400-byte heap buffer. Attackers can supply an X-FB-USER address longer than about 1016 bytes, which is formatted without a length check, to crash the IMAP service and cause denial of service.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.