A critical vulnerability in Macrium Reflect allows attackers to achieve arbitrary code execution with administrative privileges by tricking a user into mounting a malicious backup file.

The vulnerability arises from insufficient validation of companion files during the backup mounting process. An attacker can execute arbitrary code with administrator privileges if an authenticated user with high privileges opens a crafted .mrimgx or .mrbax file alongside a malicious renamed executable.

The potential for arbitrary code execution with administrative privileges poses a severe threat to system integrity and data confidentiality. Given the CVSS score of 7.7, this vulnerability represents a high risk that could lead to full system compromise, unauthorized data access, and the deployment of persistent malware within the enterprise environment.

Immediate Action: Update to the latest version of Macrium Reflect provided by the vendor, which addresses the validation flaw in the backup mounting process.

Proactive Monitoring: Monitor system logs for unexpected process execution or file system activity originating from the Macrium Reflect directory.

Compensating Controls: Ensure that users are instructed to only mount backup files from trusted, secure, and read-only locations, and avoid placing backup files in directories containing unknown or untrusted executables.

Public Exploit Available: Unknown

This vulnerability presents a significant risk to administrative workstations and servers using Macrium Reflect. IT administrators should prioritize applying the vendor-supplied security updates immediately to remediate the insufficient file validation logic and prevent potential exploitation of the backup mounting mechanism.