An issue in the Maltego Windows Installer 4.13.0 allows an attacker with local access to run arbitrary code by manipulating the installer executable resolution logic. The vulnerability does not require network exposure; it can be abused by any user who can place a malicious executable in the path expected by the installer or alter the installer’s processing of executable names. Once the installer runs the attacker’s payload, it can compromise the entire system, installing malware, elevating privileges, or extracting sensitive data.

Maltego Technologies GmbH Maltego Windows Installer 4.13.0 on Windows platforms. The vulnerability affects only the installer component; installed instances of Maltego are not reported to be impacted unless the installer has been re‑run after installation.

The vulnerability is local, so an attacker needs physical or local machine access. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, implying no publicly known exploits yet. Nevertheless, because the vulnerability grants code execution during installation, the potential impact is high should an attacker be able to run the installer. No CVSS score is supplied, so users should treat the issue as a severe local code execution flaw awaiting vendor confirmation of remediation.