CVE-2026-36213 Overview
CVE-2026-36213 is a local privilege escalation vulnerability in Microvirt MEmu Android Emulator version 9.2.7.0. The flaw resides in the MemuService.exe component, which runs with elevated privileges on Windows systems. A local attacker with low-privileged access can abuse this component to escalate privileges on the host system. The weakness is categorized under [CWE-269] Improper Privilege Management. Successful exploitation grants the attacker high impact on confidentiality, integrity, and availability of the affected host.
Critical Impact
A local attacker with standard user access can leverage MemuService.exe to gain elevated privileges on Windows hosts running MEmu 9.2.7.0.
Affected Products
- Microvirt MEmu Android Emulator 9.2.7.0
- MemuService.exe service component
- Windows hosts running the affected emulator version
Discovery Timeline
- 2026-06-15 - CVE-2026-36213 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-36213
Vulnerability Analysis
The vulnerability resides in MemuService.exe, a Windows service component installed by Microvirt MEmu Android Emulator. The service runs with elevated system privileges to manage virtualization tasks for the emulator. A local user can interact with the service in a manner that allows execution of operations beyond the user's authorized privilege level. The weakness maps to [CWE-269] Improper Privilege Management. Exploitation requires only local access and low privileges, with no user interaction needed. The EPSS data places early in-the-wild exploitation likelihood low, but the local impact remains high once an attacker has a foothold.
Root Cause
The root cause is improper privilege management within the MemuService.exe service. The component does not adequately enforce privilege boundaries between the low-privileged caller and the high-privileged service context. Operations exposed by the service can be invoked or influenced by an unprivileged local user. This design flaw enables actions that should be restricted to administrators.
Attack Vector
Exploitation is local. An attacker first obtains low-privileged code execution on a Windows host running MEmu 9.2.7.0. The attacker then interacts with MemuService.exe through its exposed interface to perform privileged operations. Successful abuse yields code execution or file or registry modification in the SYSTEM context. No verified exploit code has been published at the time of writing. Technical details and proof-of-concept artifacts are referenced in the GitHub PoC Repository.
Detection Methods for CVE-2026-36213
Indicators of Compromise
- Unexpected child processes spawned by MemuService.exe running as NT AUTHORITY\SYSTEM.
- File or registry modifications in protected system locations originating from the MEmu service process.
- Local user accounts performing IPC or named-pipe communication with MemuService.exe outside normal emulator workflows.
Detection Strategies
- Monitor process creation events where the parent is MemuService.exe and the child runs with elevated tokens.
- Audit handle and named-pipe access to the MEmu service from non-administrative user sessions.
- Correlate local logon events with subsequent privileged actions tied to the emulator service.
Monitoring Recommendations
- Enable Windows process creation auditing (Event ID 4688) with command-line logging on hosts running MEmu.
- Forward Sysmon telemetry covering process, file, and registry events to a centralized data lake for analysis.
- Alert on installation of MEmu 9.2.7.0 across managed endpoints to track exposure.
How to Mitigate CVE-2026-36213
Immediate Actions Required
- Inventory all endpoints running Microvirt MEmu 9.2.7.0 and prioritize remediation.
- Restrict installation of the MEmu emulator to systems with a documented business need.
- Remove or disable MemuService.exe on hosts where the emulator is not actively required.
Patch Information
No vendor advisory or patched version is referenced in the NVD record at the time of publication. Monitor the GitHub PoC Repository and Microvirt vendor channels for an updated release that addresses the privilege management flaw. Apply any vendor-supplied update as soon as it becomes available.
Workarounds
- Uninstall Microvirt MEmu 9.2.7.0 from systems that do not require Android emulation.
- Set the MemuService Windows service start type to Disabled when the emulator is not in use.
- Restrict local logon rights on systems where the emulator must remain installed to limit local attacker access.
# Disable the MEmu service on Windows hosts where the emulator is not required
sc.exe stop MemuService
sc.exe config MemuService start= disabled
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
