CVE-2023-26088
📋 TL;DR
This vulnerability in Malwarebytes allows attackers to delete arbitrary files via symbolic link exploitation in the local quarantine system. It affects all Windows users running Malwarebytes versions before 4.5.23. In certain scenarios, this can lead to privilege escalation.
💻 Affected Systems
- Malwarebytes for Windows
📦 What is this software?
Malwarebytes by Malwarebytes
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through privilege escalation leading to administrative control, data destruction, or ransomware deployment.
Likely Case
Local file deletion causing system instability, data loss, or disruption of security software functionality.
If Mitigated
Limited to non-critical file deletion if proper user permissions and monitoring are in place.
🎯 Exploit Status
Requires local access to the system but exploitation is straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.5.23 or later
Vendor Advisory: https://support.malwarebytes.com/hc/en-us/articles/14279575968659-Malwarebytes-for-Windows-4-5-23-Release-Notes
Restart Required: Yes
Instructions:
1. Open Malwarebytes application. 2. Click Settings (gear icon). 3. Go to About tab. 4. Click Check for Updates. 5. Install version 4.5.23 or newer. 6. Restart computer if prompted.
🔧 Temporary Workarounds
Disable Malwarebytes Quarantine
windowsTemporarily disable the quarantine feature to prevent exploitation
Not applicable - disable via Malwarebytes GUI settings
🧯 If You Can't Patch
- Implement strict access controls and monitor for unauthorized local access
- Deploy application whitelisting to prevent execution of unauthorized programs
🔍 How to Verify
Check if Vulnerable:
Check Malwarebytes version in Settings > About tab. If version is below 4.5.23, system is vulnerable.Check Version:
wmic product where "name like 'Malwarebytes%'" get versionVerify Fix Applied:
Confirm Malwarebytes version is 4.5.23 or higher in Settings > About tab.📡 Detection & Monitoring
Log Indicators:
- Unusual file deletion events in Windows Event Logs
- Malwarebytes quarantine operations on unexpected files
Network Indicators:
- No network indicators - local exploitation only
SIEM Query:
EventID=4663 AND ProcessName LIKE '%Malwarebytes%' AND AccessMask='0x10000' (Delete access)🔗 References
- https://support.malwarebytes.com/hc/en-us/articles/14279575968659-Malwarebytes-for-Windows-4-5-23-Release-Notes
- https://www.malwarebytes.com/secure/cves/cve-2023-26088
- https://support.malwarebytes.com/hc/en-us/articles/14279575968659-Malwarebytes-for-Windows-4-5-23-Release-Notes
- https://www.malwarebytes.com/secure/cves/cve-2023-26088
