The flaw lies in the MBAMService executable of Malwarebytes version 4.5, wherein the service file path is unquoted. This allows a local attacker to place malicious executables in directories that are part of the service’s path. When the system boots or the service restarts, those files run with LocalSystem privileges, giving the attacker full control over the host. The weakness is classified as CWE‑428 and results in the attacker gaining elevated privileges to execute arbitrary code.

Users who have installed Malwarebytes 4.5 on Windows and whose MBAMService configuration contains an unquoted executable path are at risk. Only this version and platform combination is documented in the CNA data; other versions are not indicated as affected.

The CVSS score of 8.5 marks this issue as high severity, and with EPSS not available the exploitation likelihood is unclear. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires local access and the ability to write to the system root path. If an attacker can place a file in the unquoted path, they can execute code with LocalSystem rights, potentially compromising the entire system.