CVE-2022-50971: Malwarebytes 4.5 Privilege Escalation via Unquoted Service Path

Technical summary

CVE-2022-50971 is an unquoted service path vulnerability (CWE-428) in the MBAMService executable of Malwarebytes 4.5. The service fails to properly quote the full executable path, creating a window for DLL or executable injection in the unquoted path. During service initialization or system reboot, Windows searches for the executable in order of precedence through unquoted path directories, allowing an authenticated local user to place a trojan in a predictable location (such as a parent directory in the service path) that executes with LocalSystem privileges. This is a post-authentication privilege escalation vector that converts local user access into system-level compromise.

Business impact

Exploitation could allow an insider threat or lateral-movement attacker to gain system-level control on endpoints running Malwarebytes 4.5, bypassing the security tool itself and potentially disabling or manipulating it. Organizations relying on Malwarebytes for endpoint protection face the risk that a compromised user account—or an attacker who has achieved user-level code execution—can silently escalate to administrative control without further user interaction or detection.

Affected systems

Malwarebytes version 4.5 is affected. This includes both enterprise and consumer deployments where the vulnerable version is still active. Check your environment for instances of Malwarebytes 4.5, particularly in Windows environments where the LocalSystem service account is in use.

Exploitability

The vulnerability requires local access (AV:L) and prior authentication (PR:L), but requires no user interaction (UI:N) once the malicious payload is placed. Exploitation is straightforward once an attacker has achieved user-level code execution or insider access—placing a file in a predictable system path and waiting for service restart. This is not an unauthenticated remote vulnerability, but it is highly effective for privilege escalation in post-compromise scenarios.

Remediation

Immediately update Malwarebytes to a patched version beyond 4.5. Verify the exact patched version against Malwarebytes' official security advisory. In the interim, apply Windows file system access controls to restrict write permissions in system root and common service path directories to authorized administrators only. Monitor service startup logs and file creation in sensitive directories for anomalies.

Patch guidance

Contact Malwarebytes support or consult their official security advisory to identify the corrected version number and obtain the update. Patch should be deployed urgently to all affected endpoints via your deployment mechanism (Malwarebytes cloud console, SCCM, or manual distribution). Test patches in a non-production environment first, then roll out systematically to production. Verify post-patch that the MBAMService executable path is properly quoted in service registry configuration (HKLM\System\CurrentControlSet\Services\MBAMService).

Detection guidance

Monitor Windows Event Viewer for Service Control Manager events indicating service path or service binary changes. Use File Integrity Monitoring (FIM) tools to alert on new executable creation in system root directories and unquoted path search locations (e.g., C:\, C:\Program Files, C:\Windows\). Log executable launches with SYSTEM privileges originating from unexpected paths. Correlate suspicious file drops with MBAMService restart events. EDR tools should flag process execution from root-level directories by non-Microsoft services.

Why prioritize this

HIGH severity (CVSS 7.8) due to high confidentiality, integrity, and availability impact. Local privilege escalation from user to SYSTEM on an endpoint is a critical control failure. While not remotely exploitable, this vulnerability can be weaponized quickly by insiders or attackers with user-level foothold, and exploitation leaves few traces if the attacker cleans up after restart. The fact that Malwarebytes is a security tool means compromise directly undermines endpoint defense.

Risk score, explained

CVSS 3.1 score of 7.8 reflects: (1) local attack vector with low attack complexity (straightforward file placement), (2) low privileges required but not none, (3) no user interaction needed post-placement, (4) high impact across confidentiality, integrity, and availability (full SYSTEM access). The score is elevated because successful exploitation grants unrestricted system control, making it a high-severity post-compromise risk.

Frequently asked questions