Executive brief
MemProcFS, a tool used for physical memory analysis and digital forensics, is vulnerable to a security flaw that allows unauthorized code execution. By placing a malicious file in the same folder as the application or modifying system environment variables, an attacker can trick the software into running their own code. This could allow an attacker to take full control of the system when a user starts the application, potentially compromising sensitive forensic evidence or corporate data.
Technical details
MemProcFS versions prior to 5.17 suffer from uncontrolled search path elements (CWE-427) due to unsafe library-loading patterns. The application uses bare-name calls to LoadLibraryU (Windows) and dlopen (Linux) without specifying absolute paths for components such as vmmpyc, libMSCompression, and various plugin DLLs. An attacker can exploit this by placing a malicious DLL or shared library in the application's working directory or by manipulating the LD_LIBRARY_PATH environment variable. When the application attempts to load these libraries, it executes the attacker's code with the privileges of the MemProcFS process. The issue is resolved in version 5.17.
Affected products
- ufrisk MemProcFS < 5.17
Timeline
- 2026-01-28: patched: Initial patch commit identified in version 5.16.13 development
- 2026-02-20: disclosed: Vulnerability disclosed by Mobasi Sentinel program
- 2026-02-22: patched: Official release of version 5.17
- 2026-04-08: advisory: NVD and VulnCheck advisories published