CVE-2023-43688: Malwarebytes and Nebula heap buffer overflow in encryption utilities

CVE-2023-43688 · Severity: info · CVSS 7.5 · Published 2026-06-09

A security vulnerability was identified in Malwarebytes and Nebula security software involving how the software handles encrypted data in memory. While the flaw could theoretically allow an attacker to disrupt the service or gain unauthorized access, the manufacturer states the risk is extremely low because the affected code was not included in the final software packages released to customers. Users are encouraged to update to the latest versions to ensure they are running the most secure and up-to-date code.

Technologies: Malwarebytes. Vendors: Malwarebytes.

Quick answers

Is CVE-2023-43688 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-43688 being exploited in the wild.
How severe is CVE-2023-43688?
Informational severity, with a CVSS score of 7.5, published 9 June 2026.
Which products and versions are affected?
Malwarebytes < 4.6.14.326; Malwarebytes Nebula Endpoint Agent < 2.0.0.64; Malwarebytes Nebula Protection Service < 4.6.17.334.
Is there a fix for CVE-2023-43688?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2023-43688 attacked?
It is attacked with local access, in a network appliance.
Am I affected by CVE-2023-43688?
Check whether you run Malwarebytes, Malwarebytes Nebula Endpoint Agent or Malwarebytes Nebula Protection Service at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow (CWE-122) was discovered in various buffer encryption utility functions within Malwarebytes 4.x, 5.x, and the Nebula platform (Endpoint Agent and Protection Service). The vulnerability stems from improper bounds checking during encryption operations. Although the vendor assigned a CVSS score of 7.5, they noted that the likelihood of exploitation is low because the specific affected utility functions were reportedly not included in the final released software packages. An attacker with local access could potentially exploit this to achieve arbitrary code execution or cause a denial-of-service condition. The issue has been addressed by removing the unused utility functions from the source code in the patched versions.

Affected products

  • Malwarebytes Malwarebytes 4.x < 4.6.14.326
  • Malwarebytes Malwarebytes 5.x < 5.1.5.116
  • Malwarebytes Nebula Endpoint Agent < 2.0.0.64
  • Malwarebytes Nebula Protection Service < 4.6.17.334

Timeline

  • 2026-06-09: advisory: NVD and vendor advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.