{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "range": [
                  {
                    "introduced": "6.0.0-B1"
                  },
                  {
                    "last_affected": "6.3.7"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandardRange"
              },
              {
                "range": [
                  {
                    "introduced": "6.0.0-B1"
                  },
                  {
                    "last_affected": "6.3.7"
                  }
                ],
                "source": "DESCRIPTION"
              }
            ]
          },
          "events": [
            {
              "introduced": "6db50deceeb402ba46ca75b5aa461cd346919e63"
            },
            {
              "last_affected": "31d656c0ce85650202b2c0f70bdd1cffa7243e34"
            }
          ],
          "repo": "https://gitlab.com/hmailserver/hmailserver",
          "type": "GIT"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "GitLab",
    "cwe_ids": [
      "CWE-295"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126621.json"
  },
  "details": "Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 on Windows hands OpenSSL the names of its own TLS files - the listeners' certificates, chains, private keys and Diffie-Hellman parameters, a port's client-certificate CA file (from 6.2.19), the object store's CA file (from 6.3.4) and the ACME client's keys and certificates - as Latin-1 bytes, which on code page 1252 are the code page's own for U+00A0 to U+00FF, and OpenSSL's file opening on Windows reads a name as UTF-8 first and opens the file at that reading when it is there, or creates it there when its folder is. When every byte of a configured name outside ASCII also reads as UTF-8 - for example U+00C3 U+00A9, the bytes C3 A9, which are U+00E9 in UTF-8 - the server used the file at that other name whenever one was there, which allows a local attacker who can create that file or its folder but cannot change the configured one, as any user can by default beside a file an administrator keeps under ProgramData, to have a port that logs on by client certificate (from 6.2.25) accept certificates from a certificate authority of the attacker's own and so sign in over the network as any mailbox without its password; to have the server trust such an authority for its object store and, intercepting that connection, read and modify the messages it stores; to receive the private keys the ACME client writes, the key of a certificate issued for the server's names among them; or to keep TLS ports from starting. The configuration is not the default: by default these files have names in ASCII, client certificates are off on every port, and the object store and ACME are off. The Linux builds are not affected.",
  "id": "CVE-2026-126621",
  "modified": "2026-11-13T02:30:53.347737028Z",
  "published": "2026-11-11T08:36:26.283Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/hmailserver/hmailserver/-/work_items/115"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126621.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126621"
    },
    {
      "type": "PACKAGE",
      "url": "https://gitlab.com/hmailserver/hmailserver"
    }
  ],
  "schema_version": "1.9.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper Certificate Validation in hMailServer"
}