CVE-2025-13433 Overview
CVE-2025-13433 is an unquoted search path vulnerability in Muse Group MuseHub version 2.1.0.1567. The flaw resides in the Muse.Updater.exe binary located at C:\Program Files\WindowsApps\Muse.MuseHub_2.1.0.1567_x64__rb9pth70m6nz6\Muse.Updater.exe, which runs as a Windows Service. The weakness is tracked under [CWE-426: Untrusted Search Path]. Exploitation requires local access and low privileges, and successful attacks can lead to code execution in the context of the service. According to the VulDB submission, the vendor was contacted about the disclosure but did not respond.
Critical Impact
A local attacker who can write to an intermediate directory on the system drive could stage a malicious executable that the service loads at startup, resulting in code execution with service-level privileges.
Affected Products
- Muse Group MuseHub 2.1.0.1567 (Windows)
- Muse.Updater.exe running as a Windows Service
- Installations located under C:\Program Files\WindowsApps\Muse.MuseHub_2.1.0.1567_x64__rb9pth70m6nz6\
Discovery Timeline
- 2025-11-20 - CVE-2025-13433 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-13433
Vulnerability Analysis
MuseHub registers a Windows Service that invokes Muse.Updater.exe using a path that is not enclosed in quotation marks. When Windows encounters an unquoted path containing spaces, the Service Control Manager attempts to launch each partial path in sequence before reaching the intended binary. An attacker with write access to any qualifying intermediate directory can place a malicious executable that the service loads before the legitimate updater.
The vulnerability is classified as high complexity because standard permissions on C:\ and C:\Program Files\ block low-privileged writes on default Windows installations. Exploitation typically depends on non-default filesystem permissions, misconfigured directories, or supplemental installers that loosen ACLs.
Root Cause
The root cause is improper handling of the service ImagePath value. The path C:\Program Files\WindowsApps\Muse.MuseHub_2.1.0.1567_x64__rb9pth70m6nz6\Muse.Updater.exe is registered without surrounding quotes. Windows parses each space-delimited token as a candidate executable, following the untrusted search order documented in [CWE-426].
Attack Vector
A local, authenticated user places a file named Program.exe in C:\ or a similarly named binary in an earlier path segment. On the next service start or system reboot, the Service Control Manager launches the attacker binary in the security context assigned to the MuseHub service. The vulnerability requires local access, low privileges, and no user interaction, but exploitation is described as difficult due to default directory ACLs.
No public proof-of-concept code has been published. Refer to the MuseHub CVE Discovery write-up and VulDB entry 332977 for technical details.
Detection Methods for CVE-2025-13433
Indicators of Compromise
- Presence of unexpected executables such as C:\Program.exe, C:\Program Files\Muse.exe, or similar files matching truncated tokens of the unquoted service path.
- Windows Service events (Event ID 7045, 7036) referencing Muse.Updater.exe launching from an unexpected parent path.
- Process creation events where services.exe spawns a binary outside the MuseHub installation directory.
Detection Strategies
- Enumerate all services on managed Windows endpoints and flag any ImagePath value that contains spaces and is not fully enclosed in quotation marks.
- Correlate Sysmon Event ID 1 (process creation) with Event ID 11 (file creation) to identify newly written executables in root or Program Files directories.
- Alert when a service configured for the MuseHub package launches a binary whose hash differs from the vendor-signed Muse.Updater.exe.
Monitoring Recommendations
- Monitor write activity to C:\, C:\Program Files\, and C:\Program Files\WindowsApps\ for non-installer processes.
- Track modifications to the HKLM\SYSTEM\CurrentControlSet\Services\ registry hive, focusing on ImagePath changes.
- Baseline the digital signature of Muse.Updater.exe and alert on unsigned or mismatched binaries executed by services.exe.
How to Mitigate CVE-2025-13433
Immediate Actions Required
- Audit the MuseHub service configuration using sc qc "MuseHubService" (or the actual service name) and confirm whether the BINARY_PATH_NAME value is quoted.
- Restrict write permissions on C:\ and other parent directories so that non-administrative users cannot create executables in the search path.
- Remove or update MuseHub 2.1.0.1567 on systems where local users have elevated write permissions on system directories.
Patch Information
No vendor patch has been published at the time of NVD publication. The VulDB submission notes that the vendor was contacted but did not respond. Track the VulDB advisory and the MuseHub CVE Discovery write-up for status updates from Muse Group.
Workarounds
- Manually correct the service definition by re-registering it with a fully quoted image path using sc config <ServiceName> binPath= "\"C:\Program Files\WindowsApps\Muse.MuseHub_2.1.0.1567_x64__rb9pth70m6nz6\Muse.Updater.exe\"".
- Verify and tighten NTFS permissions on C:\ so that only administrators and SYSTEM can create files in the root of the system drive.
- Uninstall MuseHub on shared or multi-user workstations until a fixed release is available.
# Query the service configuration and inspect BINARY_PATH_NAME for missing quotes
sc qc MuseHubService
# Enumerate all services with unquoted paths containing spaces (run as admin)
wmic service get name,pathname,startmode | findstr /i /v "\"" | findstr /i /r /c:"[A-Za-z]:\\.* .*\\.*\.exe"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
