Critical Local Privilege Escalation in MEmu Android Emulator (CVE‑2026‑36213) Allows Low‑Privileged Users to Gain SYSTEM Rights

Critical Local Privilege Escalation in MEmu Android Emulator (CVE‑2026‑36213) Allows Low‑Privileged Users to Gain SYSTEM Rights

What Happened – The MEmu Android Emulator version 9.2.7.0 installs a Windows service (MEmuSVC) that runs as NT AUTHORITY\SYSTEM. The service binary (MemuService.exe) is shipped with overly permissive NTFS ACLs, granting FullControl to the built‑in Users group and Everyone. A low‑privileged local account can replace the binary and, when the service restarts, execute arbitrary code with SYSTEM privileges.

Why It Matters for Compliance & Audit Readiness

• Demonstrates a classic incorrect permission assignment flaw that SOC 2’s Access Control criteria (CC6.1, CC6.2) are designed to detect and remediate.
• Continuous‑compliance programs must evidence that privileged services are hardened, ACLs are reviewed, and changes are logged – exactly the controls this vulnerability bypasses.
• Mapping this gap to a SOC 2 audit provides defensible proof that your organization enforces least‑privilege and monitors privileged service configurations.

Who Is Affected – Software developers, QA labs, and any organization that runs the MEmu Android Emulator on Windows workstations (primarily technology/SaaS environments and endpoint‑security tooling vendors).

Recommended Actions

• Immediately audit the ACL on C:\Program Files\Microvirt\MEmu\MemuService.exe and remove FullControl for BUILTIN\Users and Everyone.
• Re‑configure the service to run under a dedicated, least‑privileged account rather than SYSTEM where possible.
• Enable file‑integrity monitoring (e.g., Windows File Auditing, Sysmon) to alert on any modification of the service binary.
• Document the remediation in your SOC 2 access‑control evidence repository and map the fix to CC6.1 (Logical Access Controls) and CC6.2 (Least‑Privilege).

Source: Exploit‑DB #52615

Technical Notes –

• Vulnerability Type: Incorrect Access Control (CWE‑732)
• CVSS v3.1: 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
• Attack Vector: Local privilege escalation via insecure service binary permissions.
• Affected Platform: Windows 10/11 x64, MEmu Android Emulator 9.2.7.0.

Source: Exploit‑DB #52615