CVE-2020-36936
Published: 25 January 2026
Summary
CVE-2020-36936 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Magicutilities (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 2.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2020-36936 is an unquoted service path vulnerability (CWE-428) in Magic Mouse 2 Utilities version 2.20, affecting its Windows service configuration. Published on 2026-01-25, the flaw arises from the service path not being properly quoted, enabling potential executable injection. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A local attacker with low privileges can exploit this by placing a malicious executable in a directory along the unquoted service path. When the MagicMouseService restarts or the system boots, Windows may execute the malicious file instead of the legitimate one, granting elevated system privileges. This allows full control over the affected system, with high impacts to confidentiality, integrity, and availability.
Advisories, including one from VulnCheck, document the issue in the MagicMouseService configuration. A proof-of-concept exploit is publicly available on Exploit-DB (ID 49017). The vendor's site at magicutilities.net/magic-mouse/home provides additional context on the software.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4638
Vulnerability details
Magic Mouse 2 Utilities 2.20 contains an unquoted service path vulnerability in its Windows service configuration. Attackers can exploit the unquoted path to inject malicious executables and gain elevated system privileges by placing a malicious file in the service path.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path (CWE-428) in MagicMouseService directly enables path interception by placing a malicious binary in an intermediate directory that Windows resolves first on service start.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces secure configuration settings for Windows services, including proper quoting of executable paths to directly prevent unquoted service path exploitation like CVE-2020-36936.
Requires timely identification, reporting, and correction of known flaws such as the unquoted service path in MagicMouseService, mitigating privilege escalation.
Supports vulnerability scanning to identify unquoted service path vulnerabilities like CVE-2020-36936 in system configurations before exploitation.