CVE-2020-36937 Overview
CVE-2020-36937 is an unquoted service path vulnerability in Microvirt MEMU Play 3.7.0, an Android emulator for Windows. The flaw resides in the MEmusvc Windows service, where the binary path is registered without surrounding quotation marks. Local attackers with limited privileges can place a malicious executable along the unquoted path. When the service starts, Windows executes the attacker-controlled binary with LocalSystem privileges. This weakness is classified as [CWE-428] Unquoted Search Path or Element.
Critical Impact
Successful exploitation yields arbitrary code execution as LocalSystem, enabling full compromise of the affected Windows host from a low-privileged user context.
Affected Products
- Microvirt MEMU Play 3.7.0
- MEmusvc Windows service component
- Windows hosts running the vulnerable MEMU Play installation
Discovery Timeline
- 2026-01-25 - CVE-2020-36937 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2020-36937
Vulnerability Analysis
The MEmusvc service is registered in the Windows Service Control Manager with a binary path that contains spaces but lacks surrounding quotation marks. When Windows parses an unquoted ImagePath, it attempts to load each whitespace-delimited prefix as an executable before falling back to the intended target. An attacker who can write to any intermediate directory along that path can drop a malicious .exe file matching the first whitespace token. On the next service start or system reboot, the Service Control Manager executes the planted binary under the service account.
Because MEmusvc runs as LocalSystem, the planted executable inherits the highest local privilege level on Windows. The vulnerability requires local access and write permission to a directory in the unquoted path, but no user interaction is needed for execution once the service restarts.
Root Cause
The root cause is improper quoting of the service ImagePath registry value during installation. The installer registers the service binary using a path containing spaces without enclosing the full path in quotes, satisfying the conditions described by [CWE-428].
Attack Vector
Exploitation requires local code execution as a standard user with write access to a directory along the unquoted service path. The attacker places a crafted executable named to match the truncated path token, then waits for or triggers a service restart. The Service Control Manager then launches the attacker's binary as LocalSystem, completing the privilege escalation. Public proof-of-concept information is published as Exploit-DB #49016 and the VulnCheck Advisory for MemuPlay.
Detection Methods for CVE-2020-36937
Indicators of Compromise
- Unexpected executable files written to directories along the MEmusvc install path, particularly files matching the first whitespace-delimited token of the service ImagePath.
- New or modified .exe files in parent directories of the MEMU Play installation owned by non-administrative users.
- MEmusvc service starting a process whose image path does not match the legitimate MEMU Play binary.
Detection Strategies
- Audit the HKLM\SYSTEM\CurrentControlSet\Services\MEmusvc\ImagePath registry value and flag values that contain spaces without enclosing quotation marks.
- Enumerate all Windows services with wmic service get name,pathname,startmode and identify entries whose PathName contains spaces but no quotes.
- Monitor process creation events (Windows Event ID 4688, Sysmon Event ID 1) where the parent is services.exe and the child image resides outside the expected install directory.
Monitoring Recommendations
- Continuously inventory third-party Windows services and validate that all ImagePath values are properly quoted.
- Alert on file creation events targeting directories along service binary paths when the writing principal is not SYSTEM or Administrators.
- Correlate service restarts of MEmusvc with recent file write activity in parent directories to surface staging behavior.
How to Mitigate CVE-2020-36937
Immediate Actions Required
- Remove or upgrade Microvirt MEMU Play 3.7.0 on any Windows host where the emulator is not required for business use.
- Manually correct the MEmusvc service ImagePath registry value to wrap the full binary path in double quotation marks.
- Restrict write permissions on every directory along the service binary path to Administrators and SYSTEM only.
Patch Information
No vendor patch is referenced in the available advisory data. Consult the VulnCheck Advisory for MemuPlay and the Memu Play Homepage for the latest version information and apply any newer release that quotes the service path correctly.
Workarounds
- Edit the ImagePath value under HKLM\SYSTEM\CurrentControlSet\Services\MEmusvc so the full binary path is enclosed in double quotes, then restart the service.
- Apply NTFS access control lists that deny non-administrative users write access to every parent directory of the MEmusvc binary.
- Disable the MEmusvc service on hosts that do not actively use MEMU Play until the configuration is corrected.
# Configuration example: query and correct the unquoted service path
sc qc MEmusvc
reg add "HKLM\SYSTEM\CurrentControlSet\Services\MEmusvc" /v ImagePath /t REG_EXPAND_SZ /d "\"C:\Program Files\Microvirt\MEmu\MEmuService.exe\"" /f
sc stop MEmusvc
sc start MEmusvc
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
