CVE-2026-36213

HIGH

MEmu Android Emulator 9.2.7.0 - Local Privilege Escalation

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-36213 has a selected CVSS score of 7.8 (high); EIP currently links 1 catalogued exploit and 1 repository PoC.

Description

An issue in Microvirt MEmu Android Emulator 9.2.7.0 allows a local attacker to escalate privileges via the MemuService.exe component.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Repository PoCs
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 16, 2026 · Source: CVE List

Proofs of concept

2

Catalogued exploits

ExploitDBMEmu Android Emulator 9.2.7.0 - Local Privilege EscalationExploitDB exploitby MohammadExploit1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that checks for insecure NTFS permissions on MemuService.exe, replaces the binary with a malicious payload, and restarts the MEmuSVC service to execute the payload with SYSTEM privileges.

Backdoor review

No backdoor observed in reviewed code

The PoC script demonstrates a local privilege escalation by replacing a vulnerable service binary. It contains no concealed, deceptive, or operator-directed harmful behavior beyond the described exploit. The payload is a benign example that adds a local user, consistent with the stated vulnerability.

ClassificationExploit
Model confidence95%
AuthenticationRequired
Languagespython
Target softwareMEmu Android EmulatorMemuService.exe
Attack typeslocal privilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script performs the full exploit chain: checks permissions, creates a payload, replaces the vulnerable service binary, and restarts the service to execute the payload with elevated privileges. This is code intended to exercise a vulnerability, not merely detect it.

exploits/windows/local/52615.py:54-55exploits/windows/local/52615.py:178-225

Requirements

  • Low-privileged local user access on Windowsexploits/windows/local/52615.py:27
  • MEmu Android Emulator 9.2.7.0 installed with vulnerable service binary permissionsexploits/windows/local/52615.py:15-25

Observed behavior

  • Checks if running as a low-privileged user (non-admin)exploits/windows/local/52615.py:66-70
  • Verifies vulnerable permissions (FullControl for BUILTIN\Users or Everyone) on MemuService.exe using icaclsexploits/windows/local/52615.py:75-97
  • Creates a malicious payload file that adds a new admin user via net commandsexploits/windows/local/52615.py:103-121
  • Replaces the legitimate MemuService.exe with the malicious payloadexploits/windows/local/52615.py:126-145
  • Restarts the MEmuSVC service to trigger execution of the replaced binary as SYSTEMexploits/windows/local/52615.py:150-173
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Payload Behavior
Payload withheldThe payload is explicitly described as an example and performs actions consistent with a local privilege escalation demonstration.exploits/windows/local/52615.py:109-114
External Reference
Payload withheldA detection script URL is provided; no evidence it is fetched or executed by the PoC.exploits/windows/local/52615.py:232
Review boundaries

What the analysis did not establish

  • The payload is a placeholder Python script that writes a .exe file but the actual compiled executable is not provided; the script writes Python code to a file named payload.exe, which would not execute as a valid PE binary.
  • The analysis is based solely on the supplied text; no external tools, libraries, or referenced resources were inspected.
  • Only the supplied text file was reviewed; no binary files or external resources were inspected.
  • The PoC writes a payload file and replaces a service binary, which is destructive to the target system but is the intended exploit behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Repository PoCs

GitHubsec-zone/CVE-2026-36213Repository PoCby sec-zone5Writeup1 file

2.1 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a README.md file that describes a local privilege escalation vulnerability (CVE-2026-36213) in MEmu Android Emulator. It provides a technical summary, affected versions, and a conceptual proof-of-concept outline, but does not contain any executable exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a single README.md file that documents a local privilege escalation vulnerability (CVE-2026-36213) in MEmu Android Emulator. It describes the vulnerability, provides a proof-of-concept (PoC) using standard Windows command-line tools (icacls, copy, sc), and links to an external detection script. No executable code, obfuscated payloads, or instructions for unauthorized access are present within the reviewed file. The PoC demonstrates the intended vulnerability exploitation against the stated target and does not exhibit backdoor behavior.

ClassificationWriteup
Model confidence95%
AuthenticationRequired
LanguagesMarkdown
Target softwareMicrovirt MEmu Android Emulator
Attack typesLocal Privilege Escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README.md file containing a technical description of a vulnerability, including a summary, affected versions, and a conceptual proof-of-concept outline. It does not contain any executable code, scripts, or compiled binaries that could be classified as an exploit or scanner. The 'Proof of Concept' section provides only command-line examples for manual exploitation, not a functional tool. The 'Detection Script' is referenced via an external URL and is not included in the artifact.

README.md:1-66

Requirements

  • Local access to a Windows system with MEmu Android Emulator 9.2.7.0 installed.README.md:2
  • Low-privileged user account on the target system.README.md:22

Observed behavior

  • Describes that the MEmuSVC service binary has insecure NTFS permissions, allowing any local user to replace it.README.md:29-36
  • Outlines a conceptual proof-of-concept: verify permissions, replace the binary, and restart the service to execute code as SYSTEM.README.md:37-53
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

External Link
Payload withheldThe README links to an external detection script repository. The content of this external repository was not provided for review.README.md:56
Review boundaries

What the analysis did not establish

  • The artifact is a single README.md file; no executable code, scripts, or binaries are included.
  • The 'Detection Script' is only referenced by an external URL and its content is not part of the evidence.
  • The analysis is based solely on the supplied text; no dynamic execution or verification was performed.
  • Only the README.md file was provided; the external detection script repository at payload withheld was not included and its content was not analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

2