CVE-2026-107570

LowCVSS 2.5/10Last modified Oct 10, 2026

Description

heap OOB write in convert_file_from_to() via a crafted Content-Type header allows attacker to OOB write when email is used as a template.

Metrics

CVSS 3.1 2.5/10CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-823

Affected software

No affected versions have been published.

Timeline

Published
Oct 8, 2026
Last modified
Oct 10, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1075717.8Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.6 allow a local authenticated userCVE-2026-1075726.5Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account CVE-2026-1075737.8Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated userCVE-2026-1075747.5Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the CVE-2026-1075755.3Inefficient algorithmic complexity in the SPF macro expansion of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticatCVE-2026-1075767.5Inefficient algorithmic complexity in the inbound DKIM and ARC signature verification of Progressive Robot hMailServer 6.0.0 through 6.3.5 aCVE-2026-1075777.5Inefficient algorithmic complexity and a non-terminating loop in the MIME processing of received messages in Progressive Robot hMailServer 6CVE-2026-1075786.7Improper link resolution and external control of file paths in the administrative command-line operations of hMailServer.exe in Progressive CVE-2026-1075797.5Inefficient algorithmic complexity in the bounce and complaint processing of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote uCVE-2026-107587.5Esri LERC is an open-source image or raster format which supports rapid encoding and decoding for any pixel type. A Heap based Out-of-BoundsCVE-2026-1075806.5Inefficient algorithmic complexity in the decoding of message header fields in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a reCVE-2026-1075816.5Progressive Robot hMailServer 6.0.0 through 6.3.5 processes several IMAP commands from a signed-in account in time quadratic in the command'
CVE-2026-107570: Low severity, CVSS 2.5 | Vulnix