The vulnerability involves a parser in Malwarebytes 4.x and 5.x, and Nebula 2020‑10‑21 and later, that mishandles a large number of Firefox preference files. When such files are present, the parser ignores other browser configuration files, causing the Malwarebytes process to hang or crash and rendering the application unusable. The weakness arises from insufficient input validation of preference file entries (CWE‑755), limiting the impact to the Malwarebytes process but potentially preventing legitimate scanning or protection functions.

Key affected installations are Malwarebytes 4.x and 5.x and Nebula releases dated 2020‑10‑21 or newer. Users running these products on any operating system where Firefox preference files can be stored are at risk. The issue does not apply to Malwarebytes versions outside 4.x and 5.x, nor to older Nebula versions prior to 2020‑10‑21.

The CVSS score of 6.2 indicates a medium severity. EPSS is not available and the vulnerability is not listed in CISA KEV. The parser bug can be triggered by supplying a large set of Firefox preference files, which can occur if an attacker can place such files into the user’s profile directory via local or potentially remote means. While no publicly documented exploit exists, a local attacker or malicious software that can write preference files could trigger the denial of service.