Malwarebytes 4.5 Unquoted Service Path Privilege Escalation
Description
Malwarebytes 4.5 contains an unquoted service path vulnerability in the MBAMService executable that allows local attackers to escalate privileges by injecting malicious code into the system root path. Attackers can place executable files in unquoted path directories that execute with LocalSystem privileges during service startup or system reboot.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=4.5
Patches
Vulnerability mechanics
Root cause
"Unquoted service binary path allows Windows to execute an attacker-controlled executable placed in a directory earlier in the path resolution order."
Attack vector
A local attacker with write access to a directory earlier in the unquoted path (e.g., `C:\Program.exe` or `C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe`) can place a malicious executable there. When the MBAMService starts (either at boot or manually), Windows' CreateProcess resolves the unquoted path and runs the attacker's payload instead of the legitimate binary. Because the service runs as LocalSystem, the injected code inherits those elevated privileges, resulting in local privilege escalation.
Affected code
The MBAMService executable is configured with an unquoted service binary path `C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe`. Because the path contains spaces and is not enclosed in quotes, Windows will attempt to execute `C:\Program.exe`, `C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe`, etc., in order, allowing an attacker to plant a malicious executable at a higher-precedence location.
What the fix does
The advisory does not include a patch diff. To remediate the vulnerability, the vendor must enclose the service binary path in quotes (e.g., `"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"`) in the service configuration. Without quotes, Windows' path resolution logic treats each space-separated segment as a potential executable location, enabling the attack described.
Preconditions
- inputAttacker must have write access to a directory that appears earlier in the unquoted path (e.g., C:\ or C:\Program Files\Malwarebytes\Anti-Malware\)
- configThe MBAMService must be configured with an unquoted binary path (default in version 4.5.0)
- authAttacker must be a local user on the affected Windows system
Reproduction
1. Run `sc qc MBAMService` to confirm the unquoted binary path `C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe`. 2. Place a malicious executable named `Program.exe` in `C:\` (or `Malwarebytes.exe` in `C:\Program Files\`, etc.) so that Windows resolves it before the legitimate binary. 3. Restart the service or reboot the system; the malicious executable runs with LocalSystem privileges.
Generated on Jun 20, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4- www.exploit-db.com/exploits/50806mitreexploit
- www.vulncheck.com/advisories/malwarebytes-unquoted-service-path-privilege-escalationmitrethird-party-advisory
- www.malwarebytes.commitreproduct
- www.malwarebytes.com/mwb-download/mitreproduct
News mentions
0No linked articles in our index yet.