CVE-2025-34489: high-severity vulnerability in GFI MailEssentials
GFI MailEssentials < 21.8 Local Privilege Escalation
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
GFI MailEssentials before version 21.8 has a flaw that lets someone already on the computer gain full administrator access by sending a specially crafted message to a service. This is dangerous because it allows attackers to take complete control of the system.
A local privilege escalation vulnerability exists in GFI MailEssentials < 21.8 via unsafe deserialization of .NET Remoting payloads. An attacker with local access can send a malicious serialized object to the vulnerable service to achieve NT Authority/SYSTEM level execution. The attack requires local system access but bypasses normal permission restrictions.
In the same product, most dangerous first.