- Top reward
- $6,000
- Top severity paid
- Critical
- Assets in scope
- 25
- Public CVEs
- 29
- Last change
At a glance
What to know before you start testing.
- Pays up to $6,000
- for critical bugs.
- Report on HackerOne
- Submit through the program page.
Rewards
What HackerOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$6,000 from $3,000 |
| High |
|
$2,500 from $800 |
| Medium |
|
$750 from $150 |
| Low |
|
$100 from $20 |
Earlier reward tables (1)
- 12 Nov 2026 to 12 Nov 2026: Critical up to $6,000
Scope
25 assets you may test, 6 excluded.
Desktop and binaries 10
- AdwCleaner No bounty
- Malwarebytes Anti-Exploit No bounty
- Malwarebytes for Mac No bounty
- Malwarebytes for Teams No bounty
- Malwarebytes for Windows No bounty
- Malwarebytes Remediation for CrowdStrike No bounty
- Malwarebytes Support Tool (MBST) No bounty
- Malwarebytes ToolSet (MBTS) No bounty
- Malwarebytes Windows Firewall Control No bounty
- USB Flash Drive Control No bounty
Web 5
- blog.malwarebytes.com Critical No bounty
- forums.malwarebytes.com Critical No bounty
- my.malwarebytes.com Critical
- support.malwarebytes.com Critical No bounty
- www.malwarebytes.com Critical
Wildcard domains 5
- *.cyrus-security.com No bounty
- *.malwarebytes.com No bounty
- *.mbamupdates.com No bounty
- *.mwbsys.com No bounty
- *.mwb-threatintel.com No bounty
Android apps 1
- org.malwarebytes.antimalware No bounty
iOS apps 1
- com.malwarebytes.Malwarebytes Critical
Products and areas 3
- Any other Malwarebytes asset No bounty
- BrowserGuard (Firefox/Chrome/Safari browser extension) No bounty
- Malwarebytes Privacy (VPN) No bounty
Out of scope (6)
- Malwarebytes Anti-Ransomware
- estore.malwarebytes.com
- malwarebytes.zoom.us
- pages.malwarebytes.com
- store.malwarebytes.com
- view.malwarebytes.com
Changes
Tracked since 12 Nov 2026. Last checked 30 minutes ago.
-
Paused
Paused. Not accepting reports right now.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Status
Program status changed
-
Rules updated
Added: “Bug bounty program submissions have been stopped as of 23:59 PDT on 10.11.26, for both Malwarebytes and ThreatDown. All submissions already received will be han...”
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2022-50971 | Malwarebytes 4.5 contains an unquoted service path vulnerability in the MBAMService executable that allows local attackers to escalate privileges by injecting malicious code into the system root path. Attackers can place executable files in unquoted path directories that execute with LocalSystem privileges during service startup or system reboot. | High 8.5 | 19 Jun 2026 |
| CVE-2023-29144 | Malwarebytes 1.0.14 for Linux doesn't properly compute signatures in some scenarios. This allows a bypass of detection. | Low 3.3 | 12 Dec 2025 |
| CVE-2024-6260 | Malwarebytes Antimalware Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Malwarebytes Antimalware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Malwarebytes service. By cre | High 7.8 | 22 Nov 2024 |
| CVE-2024-25089 | Malwarebytes Binisoft Windows Firewall Control before 6.9.9.2 allows remote attackers to execute arbitrary code via gRPC named pipes. | Critical 9.8 | 4 Feb 2024 |
| CVE-2023-29147 | In Malwarebytes EDR 1.0.11 for Linux, it is possible to bypass the detection layers that depend on inode identifiers, because an identifier may be reused when a file is replaced, and because two files on different filesystems can have the same identifier. | Medium 5.5 | 30 Jun 2023 |
| CVE-2023-27469 | Malwarebytes Anti-Exploit 4.4.0.220 is vulnerable to arbitrary file deletion and denial of service via an ALPC message in which FullFileNamePath lacks a '\0' character. | High 7.1 | 30 Jun 2023 |
| CVE-2023-29145 | The Malwarebytes EDR 1.0.11 for Linux driver doesn't properly ensure whitelisting of executable libraries loaded by executable files, allowing arbitrary code execution. The attacker can set LD_LIBRARY_PATH, set LD_PRELOAD, or run an executable file in a debugger. | High 7.8 | 30 Jun 2023 |
| CVE-2023-36631 | Lack of access control in wfc.exe in Malwarebytes Binisoft Windows Firewall Control 6.9.2.0 allows local unprivileged users to bypass Windows Firewall restrictions via the user interface's rules tab. NOTE: the vendor's perspective is "this is intended behavior as the application can be locked using a password." | High 7.8 | 26 Jun 2023 |
| CVE-2023-28892 | Malwarebytes AdwCleaner 8.4.0 runs as Administrator and performs an insecure file delete operation on C:\AdwCleaner\Logs\AdwCleaner_Debug.log in which the target location is user-controllable, allowing a non-admin user to escalate privileges to SYSTEM via a symbolic link. | High 7.8 | 29 Mar 2023 |
| CVE-2023-26088 | In Malwarebytes before 4.5.23, a symbolic link may be used delete any arbitrary file on the system by exploiting the local quarantine system. It can also lead to privilege escalation in certain scenarios. | High 7.8 | 23 Mar 2023 |
| CVE-2022-25150 | In Malwarebytes Binisoft Windows Firewall Control before 6.8.1.0, programs executed from the Tools tab can be used to escalate privileges. | High 7.8 | 14 Feb 2022 |
| CVE-2020-25533 | An issue was discovered in Malwarebytes before 4.0 on macOS. A malicious application was able to perform a privileged action within the Malwarebytes launch daemon. The privileged service improperly validated XPC connections by relying on the PID instead of the audit token. An attacker can construct a situation where the same PID is used for running two different programs at different times, by lev | High 7.0 | 15 Jan 2021 |
| CVE-2020-28641 | In Malwarebytes Free 4.1.0.56, a symbolic link may be used delete an arbitrary file on the system by exploiting the local quarantine system. | High 7.1 | 22 Dec 2020 |
| CVE-2020-11507 | An Untrusted Search Path vulnerability in Malwarebytes AdwCleaner 8.0.3 could cause arbitrary code execution with SYSTEM privileges when a malicious DLL library is loaded. | High 7.8 | 6 Apr 2020 |
| CVE-2019-19929 | An Untrusted Search Path vulnerability in Malwarebytes AdwCleaner before 8.0.1 could cause arbitrary code execution with SYSTEM privileges when a malicious DLL library is loaded by the product. | High 7.8 | 23 Dec 2019 |
| CVE-2019-6739 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Malwarebytes Antimalware 3.6.1.2711. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page. There is an issue with the way the product handles URIs within certain schemes. The product does not warn the user that a dangerous navigation is about | High 8.8 | 3 Jun 2019 |
| CVE-2016-10717 | A vulnerability in the encryption and permission implementation of Malwarebytes Anti-Malware consumer version 2.2.1 and prior (fixed in 3.0.4) allows an attacker to take control of the whitelisting feature (exclusions.dat under %SYSTEMDRIVE%\ProgramData) to permit execution of unauthorized applications including malware and malicious websites. Files blacklisted by Malwarebytes Malware Protect can | High 7.8 | 21 Mar 2018 |
| CVE-2018-5273 | In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c40e014. NOTE: the vendor reported that they "have not been able to reproduce the issue on any Windows operating system version (32-bit or 64-bit). | High 7.8 | 8 Jan 2018 |
| CVE-2018-5274 | In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C40E024. NOTE: the vendor reported that they "have not been able to reproduce the issue on any Windows operating system version (32-bit or 64-bit). | High 7.8 | 8 Jan 2018 |
| CVE-2018-5275 | In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C40E020. NOTE: the vendor reported that they "have not been able to reproduce the issue on any Windows operating system version (32-bit or 64-bit). | High 7.8 | 8 Jan 2018 |
| CVE-2018-5276 | In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c40e018. NOTE: the vendor reported that they "have not been able to reproduce the issue on any Windows operating system version (32-bit or 64-bit). | High 7.8 | 8 Jan 2018 |
| CVE-2018-5277 | In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c40e000. NOTE: the vendor reported that they "have not been able to reproduce the issue on any Windows operating system version (32-bit or 64-bit). | High 7.8 | 8 Jan 2018 |
| CVE-2018-5278 | In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c40e00c. NOTE: the vendor reported that they "have not been able to reproduce the issue on any Windows operating system version (32-bit or 64-bit). | Low 3.3 | 8 Jan 2018 |
| CVE-2018-5279 | In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c40e02c. NOTE: the vendor reported that they "have not been able to reproduce the issue on any Windows operating system version (32-bit or 64-bit). | High 7.8 | 8 Jan 2018 |
| CVE-2018-5270 | In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c40e010. NOTE: the vendor reported that they "have not been able to reproduce the issue on any Windows operating system version (32-bit or 64-bit). | High 7.8 | 8 Jan 2018 |
| CVE-2018-5271 | In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c40e008. NOTE: the vendor reported that they "have not been able to reproduce the issue on any Windows operating system version (32-bit or 64-bit). | High 7.8 | 8 Jan 2018 |
| CVE-2018-5272 | In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c40e004. NOTE: the vendor reported that they "have not been able to reproduce the issue on any Windows operating system version (32-bit or 64-bit). | High 7.8 | 8 Jan 2018 |
| CVE-2014-100039 | mbae.sys in Malwarebytes Anti-Exploit before 1.05.1.2014 allows local users to cause a denial of service (crash) via a crafted size in an unspecified IOCTL call, which triggers an out-of-bounds read. NOTE: some of these details are obtained from third party information. | Low 2.1 | 13 Jan 2015 |
| CVE-2014-4936 | The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.1012 and earlier allow man-in-the-middle attackers to execute arbitrary code by spoofing the update server and uploading an executable. | High 9.3 | 16 Dec 2014 |