CVE-2021-47863
Published: 21 January 2026
Summary
CVE-2021-47863 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Macpaw (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 2.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
MacPaw Encrypto 1.0.1 contains an unquoted service path vulnerability (CWE-428) in its Encrypto Service configuration, affecting Windows systems. The issue stems from an unquoted path in C:\Program Files\Encrypto\, which allows local attackers to potentially execute arbitrary code. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability.
Local attackers with low privileges can exploit this vulnerability by placing a malicious executable in a directory that precedes the legitimate service binary in the system's search path resolution. Successful exploitation enables arbitrary code execution and privilege escalation on the targeted Windows system, as the service runs with elevated privileges.
Advisories and references, including the VulnCheck advisory at https://www.vulncheck.com/advisories/macpaw-encrypto-encrypto-service-unquoted-service-path, the vendor site at https://macpaw.com/encrypto, and a proof-of-concept exploit at https://www.exploit-db.com/exploits/49694, provide details on the issue and potential mitigations such as updating to a patched version or correcting the service path configuration. Security practitioners should review these sources for specific remediation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3643
Vulnerability details
MacPaw Encrypto 1.0.1 contains an unquoted service path vulnerability in its Encrypto Service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in C:\Program Files\Encrypto\ to inject malicious executables and escalate privileges on…
more
Windows systems.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct match to unquoted service path (CWE-428) enabling path interception for service hijacking and privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires identification, reporting, and correction of flaws like the unquoted service path vulnerability through patching or reconfiguration to prevent exploitation.
Enforces secure baseline configuration settings for services, including properly quoted executable paths, to block path hijacking by malicious binaries.
Applies least privilege to services running with elevated rights, limiting the impact of privilege escalation even if the unquoted path is exploited.