Executive brief
A security vulnerability in the MEmu Android Emulator allows a standard user on a Windows computer to gain full administrative control over the system. The software's background service is configured with incorrect security settings, allowing its core files to be replaced by any user. An attacker can exploit this to run malicious code with the highest possible system privileges, potentially leading to complete data theft or persistent system compromise.
Technical details
A Local Privilege Escalation (LPE) vulnerability exists in MEmu Android Emulator version 9.2.7.0 and earlier due to insecure NTFS permissions on the 'MemuService.exe' binary. The service 'MEmuSVC' executes with NT AUTHORITY\SYSTEM privileges, but its executable file is located in a directory where 'BUILTIN\Users' and 'Everyone' groups have Full Control (F) permissions. A local attacker with low privileges can replace the legitimate service binary with a malicious executable. Upon the next service restart or system reboot, the attacker's code will execute with SYSTEM-level privileges. This issue is categorized under CWE-732 (Insecure Permission Assignment) and was patched in version 9.3.2.
Affected products
- Microvirt MEmu Android Emulator 9.2.7.0 and earlier
Timeline
- 2026-06-15: disclosed
- 2026-06-15: advisory: NVD publication date
- 2026-06-15: patched: Fixed in version 9.3.2