The cryptographic hash routine in Malwarebytes EDR 1.0.11 truncates input larger than 4 GB, causing an unsigned 32‑bit counter to wrap around. This bug allows an attacker to create two distinct strings that yield the same hash by appending a 4‑GB payload to a shorter string. If the hash is used for integrity or authentication checks, the collision can undermine those mechanisms, enabling forged content to appear authentic; this is inferred from the description.

Malwarebytes EDR for Linux, version 1.0.11. No other vendors or products are currently listed as affected.

No public exploits are known, and the EPSS score is unavailable. The collision requires delivering a payload larger than 4 GB, which limits attacker access to contexts that allow arbitrarily large inputs; therefore, the actual risk depends on how the hash is applied. The CVSS score of 8.2 indicates high severity. Since the vulnerability is not listed in the CISA KEV catalog, no widespread exploitation has been observed. A likely attack vector is remote submission of a large payload to an application that consumes data unsecured, though this is inferred from the need for a >4 GB input.