Skip to content
Fencer Intel
critical 9.3

CVE-2014-4936 in the critical feed json

The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.10…

published 2014-12-16 11 y ago modified 2026-06-17 4 mo ago also EUVD-2014-4853

cvss
9.3
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
16.8%
EPSS 16.8% chance of exploitation in 30 days, percentile 97%
public exploits
2
Metasploit, Exploit-DB

Summary

The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.1012 and earlier allow man-in-the-middle attackers to execute arbitrary code by spoofing the update server and uploading an executable.

Timeline

  1. First public exploit (Metasploit exploit/windows/browser/malwarebytes_update_exec)
  2. Published

Exploit prediction

16.78% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • Metasploit exploit/windows/browser/malwarebytes_update_exec Malwarebytes Anti-Malware and Anti-Exploit Update Remote Code Execution metasploit exploit, good rank, 2014-12-16
  • EDB-41701 Malwarebytes Anti-Malware < 2.0.3 / Anti-Exploit < 1.03.1.1220 - Update Code Execution (Metasploit) local, 2014-12-16
  • blog.0x3a.com http://blog.0x3a.com/post/104954032239/cve-2014-4936-malwarebytes-anti-malware-and referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-345 Insufficient Verification of Data Authenticity

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.