What is the CVSS score of CVE-2026-36213?

CVE-2026-36213 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of MEmu Android Emulator are affected by CVE-2026-36213?

Microvirt MEmu Android Emulator 9.2.7.0 contains a local privilege escalation vulnerability in the MemuService.exe component that allows low-privileged users to gain elevated host system rights.

Is there a public PoC exploit available for CVE-2026-36213?

Yes, a public proof-of-concept exploit is available for CVE-2026-36213. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-36213?

Within 24 hours: Inventory all systems running MEmu 9.2.7.0 and restrict local system access to trusted users only. Within 7 days: Evaluate alternative Android emulation platforms (Android Studio Emulator, BlueStacks) and initiate migration planning for critical workflows. Within 30 days: Migrate away from MEmu 9.2.7.0 or implement compensating controls including host-level access restrictions, application whitelisting of MemuService.exe, and process monitoring; establish alerts for vendor patch announcements.

MEmu Android Emulator CVE-2026-36213

EUVD-2026-36745 HIGH

Improper Privilege Management (CWE-269)

2026-06-15 mitre

GHSA-cf5p-6872-pq2q

Privilege Escalation Google N A

7.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local attacker with standard user rights (AV:L/PR:L) abuses a SYSTEM service with no user interaction, yielding full host CIA impact within the same scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 15:28 vuln.today

CVSS changed

Jun 16, 2026 - 15:22 NVD

7.8 (HIGH)

CVE Published

Jun 15, 2026 - 00:00 cve.org

HIGH 7.8

CVE Published

Jun 15, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in Microvirt MEmu Android Emulator 9.2.7.0 allows a local attacker to escalate privileges via the MemuService.exe component.

AnalysisAI

Local privilege escalation in Microvirt MEmu Android Emulator 9.2.7.0 allows a low-privileged local user to abuse the MemuService.exe component to gain elevated rights on the host Windows system. Mapped to CWE-269 (Improper Privilege Management), with no public exploit identified at time of analysis and an EPSS score of 0.21% indicating low predicted exploitation likelihood. Researcher PoC repository exists on GitHub (sec-zone/CVE-2026-36213) but active exploitation has not been reported.

Technical ContextAI

MEmu is a Windows-based Android emulator from Microvirt that installs a persistent helper service, MemuService.exe, typically running with SYSTEM privileges to manage virtualization, networking, and shared folders for guest Android instances. CWE-269 (Improper Privilege Management) in this context indicates that the service exposes a control surface - likely an IPC endpoint, named pipe, weak DACL on the service binary/directory, or an unquoted/insecure service path - that a low-privileged local user can interact with to perform operations beyond their authorization level. The CPE entry is unhelpfully populated as 'n/a:n/a', so authoritative product scoping must rely on the vendor name (Microvirt) and the version string (9.2.7.0) given in the description.

RemediationAI

No vendor-released patch identified at time of analysis - Microvirt has not published an advisory or fixed version through the references provided. Until a fixed build is released, compensating controls include uninstalling MEmu from systems where it is not business-critical (trade-off: loss of Android emulation capability), restricting interactive logon on hosts where MEmu is installed so untrusted local users cannot reach MemuService.exe, and monitoring the MemuService.exe process and its installation directory (typically under %ProgramFiles%\Microvirt\MEmu) for unexpected child processes or file writes by non-admin users. Consult the researcher write-up at https://github.com/sec-zone/CVE-2026-36213 to identify the specific abused interface and consider applying an explicit deny ACL on the affected pipe/binary/service control entry if feasible (trade-off: may break legitimate MEmu functionality).