Privilege Escalation in MEmu Android Emulator

Compliance Impact

The provided information does not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-36213 is a Local Privilege Escalation vulnerability in the MEmu Android Emulator version 9.2.7.0 and earlier. The issue occurs because the MEmuService.exe binary, which is part of the MEmuSVC service running with SYSTEM privileges, has insecure NTFS permissions. Specifically, the binary is world-writable, allowing any local user to modify or replace it.

An attacker can exploit this vulnerability by replacing the legitimate MEmuService.exe binary with a malicious executable. When the service restarts, the malicious code runs with SYSTEM-level privileges, effectively escalating the attacker's privileges on the system.

This vulnerability has been assigned a CVSS v3.1 score of 7.8 (HIGH) due to its local attack vector, low complexity, and low required privileges.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a local attacker to escalate their privileges to SYSTEM level on a machine running the vulnerable MEmu Android Emulator. This means an attacker with limited access could gain full control over the affected system.

• Execution of arbitrary code with SYSTEM privileges.
• Potential full compromise of the affected system.
• Ability to bypass security restrictions and access sensitive data or system resources.
• Installation of persistent malware or backdoors.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking the NTFS permissions of the MEmuService.exe binary to see if the "Users" group and "Everyone" have Full Control permissions, which makes the binary world-writable.

A detection script is available on GitHub to identify such insecure configurations.

• Use the command to check permissions on the binary (example for Windows): icacls "path\to\MEmuService.exe"
• Look for entries granting Full Control (F) to "Users" or "Everyone".

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation is to update the MEmu Android Emulator to version 9.3.2 or later, where this vulnerability is patched.

Alternatively, restrict the NTFS permissions on the MEmuService.exe binary to remove Full Control permissions from the "Users" and "Everyone" groups, ensuring only trusted accounts have write access.

After fixing permissions, restart the MEmuSVC service to ensure no malicious binary is running.

Useful 0 Not Useful 0