CVE-2026-36213-poc

CVE-2026-36213: MEmu Android Emulator 9.2.7.0 Local Privilege Escalation

https://img.shields.io/badge/platform-Windows-blue https://img.shields.io/badge/CVE-2026--36213-red https://img.shields.io/badge/EDB--ID-52615-orange

Overview

This repository contains a Python proof-of-concept (PoC) for CVE-2026-36213, a local privilege escalation vulnerability in MEmu Android Emulator 9.2.7.0 on Windows.

The vulnerability exists due to insecure NTFS permissions on the MEmuSVC service binary (MemuService.exe), which runs with NT AUTHORITY\SYSTEM privileges. Low-privileged users can replace the binary, leading to arbitrary code execution as SYSTEM upon service restart.

· CVE: CVE-2026-36213 · EDB-ID: 52615 · Type: Local Privilege Escalation · CWE: CWE-732 (Incorrect Permission Assignment for Critical Resource) · CVSS v3.1: 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Vulnerability Details

MEmu installs a Windows service named MEmuSVC that executes as NT AUTHORITY\SYSTEM. The service binary located at:

C:\Program Files\Microvirt\MEmu\MemuService.exe

is configured with weak NTFS permissions, granting FullControl (F) to:

· BUILTIN\Users · Everyone

A low-privileged local user can overwrite this binary with a malicious executable. When the service is restarted (either manually, via system reboot, or by other means), the payload executes with SYSTEM privileges.

Requirements

· Windows 10 / 11 x64 · Python 3.x · .NET Framework 4.0+ (for csc.exe to compile the payload) · MEmu Android Emulator 9.2.7.0 installed (default path)

Usage

1. Save the PoC script as CVE-2026-36213.py.
2. Open a command prompt as a low-privileged user (not administrator).
3. Run:
   root@kitploit:~

   python CVE-2026-36213.py
   

4. The script will: · Verify vulnerable permissions on MemuService.exe · Compile a benign payload that writes C:\Windows\Temp\pwned.txt · Backup the original binary and replace it with the payload · Attempt to restart the MEmuSVC service
5. After execution, check the marker file:
   root@kitploit:~

   C:\Windows\Temp\pwned.txt
   

   If successful, it will contain output from whoami showing nt authority\system.

Note: If the script cannot restart the service due to lack of permissions, manually restart the service or reboot the machine to trigger the payload.

Detection

To check if a system is vulnerable, run:

icacls "C:\Program Files\Microvirt\MEmu\MemuService.exe"

Vulnerable output includes:

BUILTIN\Users:(F)
Everyone:(F)

Remediation

· Vendor fix: Microvirt should correct the NTFS permissions on MemuService.exe. · Manual mitigation: Administrators can restrict permissions with:

icacls "C:\Program Files\Microvirt\MEmu\MemuService.exe" /inheritance:r /grant:r "SYSTEM:(F)" "Administrators:(F)"

This removes inherited permissions and grants FullControl only to SYSTEM and Administrators.

Disclaimer

This PoC is provided for authorized security testing and educational purposes only. Do not use it against systems you do not own or have explicit written permission to test. The author assumes no liability for any misuse or damage caused by this code.

References

· Exploit-DB 52615 · NVD - CVE-2026-36213 · CWE-732