CVE-2022-50971CWE-428

CVE-2022-50971

High · published June 19, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
12.4
In the wild
Unconfirmed
What it is

Malwarebytes 4.5 contains an unquoted service path vulnerability in the MBAMService executable that allows local attackers to escalate privileges by injecting malicious code into the system root path. Attackers can place executable files in unquoted path directories that execute with LocalSystem privileges during service startup or system reboot.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00225 · 12.4th percentile
Weakness
CWE-428 · Unquoted Search Path or Element
Published
2026-06-19T19:16Z
Affected products (1)
ProductVersionsFixed in
malwarebytes/malwarebytes≤ 4.5.0—
References (4)
https://www.exploit-db.com/exploits/50806 · [email protected]https://www.malwarebytes.com/ · [email protected]https://www.malwarebytes.com/mwb-download/ · [email protected]https://www.vulncheck.com/advisories/malwarebytes-unquoted-service-path-privilege-escalation · [email protected]
EPSS history
Timeline
  • 19 JUN 14:16Z
    Malwarebytes 4.5 Unquoted Service Path Privilege Escalation
    cvelistv5