The vulnerability is caused by hMailServer’s anti‑virus attachment‑stripping action failing to enforce its intended behavior when the message contains only non‑text parts; the action keeps the text part but replaces attachments with a note, but if the message has no text part, such as an entire program, archive, or S/MIME signing, the action does nothing and delivers the original content unchanged. Any sender can write such a message.

The flaw affects Progressive Robot Ltd’s hMailServer versions 6.0.0 through 6.3.6. Users running these releases, without the patch, remain vulnerable to receiving infected mail.

The CVSS score is 5.8, indicating moderate severity. The EPSS score is not available, and the issue is not yet listed in CISA’s KEV catalog. The vulnerability is reachable by remote, unauthenticated attackers via standard SMTP email delivery, so anyone with access to the server’s inbound mail flow can exploit it. While the lack of an EPSS rating suggests low to moderate exploitation likelihood, the ubiquity of email and the lack of client‑side filtering make the risk tangible. Because the flaw allows infected messages to reach user mailboxes, it directly threatens confidentiality and integrity of email content.