Is CVE-2022-50971 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-50971 being exploited in the wild.

How severe is CVE-2022-50971?

High severity, with a CVSS score of 7.8, published 19 June 2026.

Which products and versions are affected?

Malwarebytes 4.5.0 and earlier.

Is there a fix for CVE-2022-50971?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2022-50971 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2022-50971?

Check whether you run Malwarebytes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-50971: Malwarebytes Unquoted Service Path Privilege Escalation in MBAMService

CVE-2022-50971 · Severity: high · CVSS 7.8 · Published 2026-06-19

Malwarebytes 4.5 is an antivirus and security software suite used to protect computers from malicious software. A vulnerability in how the software starts its background service allows a person with limited access to the computer to trick the system into running their own malicious code with full administrative control. This could lead to a complete takeover of the machine, allowing an attacker to bypass security settings or access sensitive data.

Technologies: Malwarebytes. Vendors: Malwarebytes.

Quick answers

Is CVE-2022-50971 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-50971 being exploited in the wild.
How severe is CVE-2022-50971?: High severity, with a CVSS score of 7.8, published 19 June 2026.
Which products and versions are affected?: Malwarebytes 4.5.0 and earlier.
Is there a fix for CVE-2022-50971?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2022-50971 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2022-50971?: Check whether you run Malwarebytes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An unquoted service path vulnerability (CWE-428) exists in the MBAMService executable within Malwarebytes version 4.5.0 and potentially earlier. The service's binary path contains spaces and is not enclosed in quotation marks, which allows a local attacker with write permissions to the system root or intermediate directories to place a malicious executable (e.g., C:\Program.exe). Because the service runs with LocalSystem privileges, the malicious file will be executed with elevated permissions during the next service start or system reboot. This is a local attack vector requiring prior access to the filesystem but no user interaction.

Affected products

Malwarebytes Malwarebytes 4.5.0 and earlier

Timeline

2022-03-07: other: Exploit first published on Exploit-DB
2026-06-19: advisory: NVD/VulnCheck advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.