Attack Chain

1. Initial Access: A low-privileged attacker gains local access to a Windows system running MEmu Android Emulator 9.2.7.0.
2. Vulnerability Identification: The attacker identifies the MEmuSVC service running with NT AUTHORITY\SYSTEM privileges and its associated binary C:\Program Files\Microvirt\MEmu\MemuService.exe.
3. Permission Check: The attacker verifies the insecure NTFS permissions on MemuService.exe (e.g., using icacls), confirming that BUILTIN\Users or Everyone have FullControl access.
4. Payload Creation: The attacker crafts a malicious executable (e.g., payload.exe) designed to perform actions like creating a new administrative user or establishing persistence.
5. Binary Replacement: The attacker exploits the insecure permissions to replace the legitimate C:\Program Files\Microvirt\MEmu\MemuService.exe with their payload.exe.
6. Service Control: The attacker stops the MEmuSVC service using sc stop MEmuSVC.
7. Privilege Escalation: The attacker starts the MEmuSVC service using sc start MEmuSVC, which executes the malicious payload.exe with NT AUTHORITY\SYSTEM privileges.
8. Impact: The malicious payload successfully executes, granting the attacker SYSTEM-level control over the compromised system.

Impact

Successful exploitation of CVE-2026-36213 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM, granting complete control over the compromised Windows system. This level of access enables attackers to install malware, modify system configurations, access sensitive data, create new administrative accounts, and potentially move laterally within the network. While the source does not specify victim counts or targeted sectors, any organization or individual using the vulnerable MEmu Android Emulator is at risk of full system compromise if an attacker gains initial local access.

Recommendation

• Patch Immediately: Update MEmu Android Emulator to a patched version that addresses CVE-2026-36213 as soon as one is available from Microvirt.
• File Integrity Monitoring: Deploy file integrity monitoring (FIM) on C:\Program Files\Microvirt\MEmu\MemuService.exe to detect unauthorized modifications.
• Endpoint Detection: Deploy the Sigma rules provided in this brief to your SIEM/EDR to detect attempts to replace the service binary or manipulate the MEmuSVC service.
• Sysmon Logging: Enable Sysmon process creation (Event ID 1) and file creation/modification (Event ID 11) logging to activate the detection rules.