Macro Expert 4.7 - Unquoted Service Path | Advisories

Advisories

Macro Expert 4.7 - Unquoted Service Path

severity: high
date: January 15, 2026
Affecting: Macro Expert 4.7
CVE: CVE-2021-47780
CWE: CWE-428 Unquoted Search Path or Element
CVSS: 8.5
CVSS V4 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References: ExploitDB-50431
Macro Expert Official Website
Credit: Mert DAŞ
Description: Macro Expert 4.7 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the improperly configured service path to inject malicious executables that will be run with LocalSystem permissions during service startup.