CVE-2022-50971: 
Homebrew vulnerability analysis and mitigation

CVE-2022-50971 is an unquoted service path vulnerability (CWE-428) in Malwarebytes 4.5 for Windows that allows local attackers to escalate privileges to LocalSystem by placing malicious executables in unquoted path directories executed during service startup or system reboot. The vulnerability affects Malwarebytes versions up to and including 4.5.0 on Windows. It was published on June 19, 2026, and assigned by VulnCheck. The CVSS v3.1 base score is 7.8 (High) and the CVSS v4.0 base score is 8.5 (High) (GitHub Advisory, VulnCheck Advisory).

The root cause is CWE-428 (Unquoted Search Path or Element): the MBAMService executable's service path contains spaces but is not enclosed in quotation marks in the Windows service configuration. When Windows resolves the unquoted path, it attempts to execute files matching partial path segments — for example, if the service path is C:\Program Files\Malwarebytes\..., Windows may first attempt to execute C:\Program.exe. A local attacker with write access to a parent directory in the path can place a malicious executable at one of these intermediate locations, which will then be executed with LocalSystem privileges when the service starts or the system reboots. Exploitation requires low-privilege local access and no user interaction (GitHub Advisory, Exploit-DB).

Successful exploitation grants the attacker code execution with LocalSystem privileges — the highest privilege level on a Windows system — resulting in full confidentiality, integrity, and availability compromise of the affected host. An attacker can read sensitive data, modify system files, install persistent backdoors, disable security software, and use the compromised system as a pivot point for lateral movement within the network. The impact is confined to the vulnerable system itself (no subsequent system impact in CVSS v4.0 terms), but the LocalSystem context makes post-exploitation highly effective (GitHub Advisory, VulnCheck Advisory).

1. Reconnaissance: Identify systems running Malwarebytes 4.5.0 or earlier on Windows. Use local enumeration tools (e.g., wmic service get name,pathname,startmode or PowerShell Get-WmiObject Win32_Service) to confirm the MBAMService path is unquoted and contains spaces.
2. Identify vulnerable path segment: Determine the unquoted service path for MBAMService (e.g., C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe) and identify which parent directory segment is exploitable (e.g., C:\Program.exe or C:\Program Files\Malwarebytes.exe).
3. Check write permissions: Verify that the local low-privileged user account has write access to the target parent directory (e.g., C:\ or another directory in the path) using icacls or similar tools.
4. Place malicious executable: Craft or compile a malicious executable (e.g., a reverse shell or privilege-escalating payload) and place it at the exploitable path location (e.g., C:\Program.exe).
5. Trigger execution: Wait for the MBAMService to restart (e.g., via system reboot or service restart) — Windows will resolve the unquoted path and execute the malicious binary with LocalSystem privileges before reaching the legitimate service executable.
6. Achieve privilege escalation: The malicious payload executes as LocalSystem, granting full system control (Exploit-DB, GitHub Advisory).

• Process: Unexpected processes spawned with LocalSystem privileges (e.g., cmd.exe, powershell.exe, reverse shell binaries) as children of the Windows Service Control Manager (services.exe) around service startup or reboot time.
• File System: Presence of unexpected executable files in system root or intermediate path directories (e.g., C:\Program.exe, C:\Program Files\Malwarebytes.exe) that do not belong to legitimate software.
• Logs: Windows Event Log entries (Event ID 7036 or 7045) showing MBAMService state changes; Security Event Log entries (Event ID 4688) showing new process creation with LocalSystem context from unexpected parent paths at boot/service-start time.
• Registry: Inspection of HKLM\SYSTEM\CurrentControlSet\Services\MBAMService — the ImagePath value should be quoted; an unquoted value confirms the vulnerable configuration is present.

The primary remediation is to update Malwarebytes to a version released after 4.5.0, which addresses the unquoted service path (VulnCheck Advisory). As a workaround prior to patching, administrators should restrict write permissions on directories in the MBAMService executable path (particularly the system root C:\) to prevent low-privileged users from placing executables there. Additionally, auditing Windows services for unquoted paths using tools like wmic service get name,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\" can help identify exposure. Implementing application whitelisting (e.g., Windows Defender Application Control) can also prevent unauthorized executables from running in these locations.