CVE-2023-28892

HIGH

Malwarebytes AdwCleaner 8.4.0 - Privilege Escalation

Title source: llm

Description

Malwarebytes AdwCleaner 8.4.0 runs as Administrator and performs an insecure file delete operation on C:\AdwCleaner\Logs\AdwCleaner_Debug.log in which the target location is user-controllable, allowing a non-admin user to escalate privileges to SYSTEM via a symbolic link.

References (3)

Core 3

Core References

Product

https://malwarebytes.com

Vendor Advisory

https://www.malwarebytes.com/secure/cves/cve-2023-28892

Various Sources

https://forums.malwarebytes.com/topic/307429-release-adwcleaner-841/

Scores

CVSS v3 7.8

EPSS 0.0049

EPSS Percentile 38.0%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-59

Status published

Products (1)

malwarebytes/adwcleaner < 8.4.0

Published Mar 29, 2023

Tracked Since Feb 18, 2026