CVE-2000-1128: The default configuration of McAfee VirusScan 4.5 does not quote the ImagePath variable, which improperly s...

Security readout for executives and security teams

McAfee VirusScan 4.5 shipped with a Windows service configuration flaw where the executable path was not enclosed in quotes. On systems where a low-privileged user could drop a file into the C:\Program Files directory, that user could trick Windows into running their file with the antivirus service's high privileges, taking over the machine. The issue is decades old and applies only to this legacy product. Exposure is limited to end-of-life environments still running McAfee VirusScan 4.5 on legacy Windows systems where non-administrative users have write access to C:\Program Files. Modern Windows installs restrict that directory, and this product has been out of support for over two decades, so real-world exposure in supported enterprise fleets should be negligible. Very low priority for modern environments. Only matters if the business still operates unsupported Windows hosts with McAfee VirusScan 4.5, in which case the correct action is decommissioning the legacy stack rather than patching this single CVE. Mitigation focus: Retire McAfee VirusScan 4.5 and migrate to a currently supported endpoint protection product.; Ensure C:\Program Files ACLs deny write access to non-administrative users.; Audit service ImagePath registry values on legacy hosts and quote paths containing spaces..

Prepared

Jul 12, 2026, 00:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.