Executive brief
A vulnerability in Malwarebytes security software could allow attackers to bypass security detections. The software's mechanism for identifying files via cryptographic hashes fails when processing very large files (over 4GB), potentially allowing malicious files to be misidentified as safe. This could lead to a failure in threat detection, allowing malware to remain on a system undetected.
Technical details
An integer overflow (CWE-190) exists in the utility functions used for calculating cryptographic hashes in Malwarebytes Endpoint Agent for Linux and Malwarebytes for Windows v5. When processing data exceeding 4GB, the software truncates the data due to a 32-bit integer wrap-around. An attacker can exploit this by appending 4GB of data to a specific string to create a hash collision with a different, smaller string. This flaw can be leveraged to bypass security scanners and detection engines that rely on file hashing for identification. Patches are available in Endpoint Agent for Linux version 1.1.64 and Malwarebytes for Windows v5 update package 1.0.106875.
Affected products
- Malwarebytes Endpoint Agent for Linux < 1.1.64
- Malwarebytes Malwarebytes for Windows v5 Update package version < 1.0.106875
Timeline
- 2026-06-09: disclosed: NVD publication date
- 2026-06-09: advisory