CVE-2019-25568 Overview
CVE-2019-25568 is a privilege escalation vulnerability in Memu Play 6.0.7, an Android emulator developed by Microvirt. The flaw stems from insecure file permissions on the MemuService.exe binary within the installation directory. Low-privilege users can rename and overwrite this executable with a malicious payload. When the associated service restarts after a system reboot, the attacker's binary executes with SYSTEM privileges. The vulnerability is classified under [CWE-306] (Missing Authentication for Critical Function) and enables full local privilege escalation on affected Windows hosts.
Critical Impact
Local attackers with limited user rights can replace MemuService.exe to gain SYSTEM-level code execution after the next reboot.
Affected Products
- Microvirt Memu Play 6.0.7
- Microvirt Memu (versions sharing the vulnerable installation permissions)
- Windows hosts running the Memu Android emulator
Discovery Timeline
- 2026-03-21 - CVE-2019-25568 published to NVD
- 2026-04-21 - Last updated in NVD database
Technical Details for CVE-2019-25568
Vulnerability Analysis
The vulnerability resides in the Windows installation directory of Memu Play 6.0.7. The installer applies access control entries (ACEs) that grant non-privileged users write access to files within the installation path. MemuService.exe runs as a Windows service under the LocalSystem account. Because the binary itself is writable by low-privilege users, the integrity boundary between standard users and the service is broken. An attacker renames the legitimate MemuService.exe and drops a malicious replacement under the same name. The Service Control Manager loads the attacker-controlled binary on the next service start, typically triggered by a reboot.
Root Cause
The root cause is improper assignment of NTFS permissions on the Memu Play installation directory. Standard users hold Modify or Full Control rights on a binary executed by a SYSTEM-level service. This violates the principle of least privilege and aligns with [CWE-306], where authentication or access control is missing for a critical function — in this case, modification of a service executable.
Attack Vector
An authenticated local user navigates to the Memu installation directory. The user renames the existing MemuService.exe and writes a malicious executable using the same filename. The user then waits for a reboot or triggers a service restart through normal user-level mechanisms. On service startup, Windows invokes the replaced binary under the LocalSystem security context, granting the attacker full host control. The flaw requires only local access and no elevated privileges to stage the payload.
No verified public exploit code is referenced in the enriched data. Technical detail and proof-of-concept material are documented in the Exploit-DB #46437 entry and the VulnCheck Advisory on Memu Play.
Detection Methods for CVE-2019-25568
Indicators of Compromise
- Modification timestamp on MemuService.exe that does not match the original installer date
- Presence of a renamed copy of the original MemuService.exe in the Memu installation directory
- Unexpected child processes spawned by MemuService.exe running as NT AUTHORITY\SYSTEM
- Service binary path pointing to an executable with non-Microvirt digital signature or no signature
Detection Strategies
- Monitor file write and rename events targeting executables inside the Memu Play installation directory.
- Alert on changes to service ImagePath registry values under HKLM\SYSTEM\CurrentControlSet\Services\ for Memu-related services.
- Compare hashes of MemuService.exe against the known-good vendor hash after install.
- Hunt for non-standard processes launched by MemuService.exe performing reconnaissance or persistence actions.
Monitoring Recommendations
- Enable Windows Security event logging for file modifications (Event ID 4663) on the Memu directory.
- Forward Sysmon Event ID 11 (FileCreate) and Event ID 7 (Image loaded) for service executables to a centralized log platform.
- Track Event ID 7045 (service installed) and 4697 to detect unauthorized service binary swaps.
- Audit NTFS DACLs on third-party application directories quarterly to identify writable service binaries.
How to Mitigate CVE-2019-25568
Immediate Actions Required
- Restrict NTFS permissions on the Memu Play installation directory so that only administrators have write access to executables.
- Verify the integrity of MemuService.exe against the vendor-supplied hash and replace it if tampering is suspected.
- Remove Memu Play from systems where the emulator is not required for business operations.
- Audit other third-party services on the host for similar insecure installation directory permissions.
Patch Information
No vendor advisory or patched version is referenced in the enriched CVE data. Consult the VulnCheck Advisory on Memu Play and the Memu Play Official Site for the latest release. Upgrade to the most recent Memu Play build and reapply hardened ACLs after installation.
Workarounds
- Apply icacls to remove write and modify rights for non-administrative users on the Memu installation folder.
- Configure the Memu service to run under a lower-privilege account where supported by the application.
- Use AppLocker or Windows Defender Application Control to block execution of unsigned binaries from the Memu directory.
- Restrict interactive logon on hosts running Memu Play to trusted administrative users.
# Configuration example: harden permissions on the Memu installation directory
icacls "C:\Program Files\Microvirt\MEmu" /inheritance:r
icacls "C:\Program Files\Microvirt\MEmu" /grant:r "Administrators:(OI)(CI)F"
icacls "C:\Program Files\Microvirt\MEmu" /grant:r "SYSTEM:(OI)(CI)F"
icacls "C:\Program Files\Microvirt\MEmu" /grant:r "Users:(OI)(CI)RX"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
