Which versions of Memprocfs are affected by EUVD-2026-20773?

ufrisk MemProcFS versions before 5.17 contain DLL and shared-library hijacking vulnerabilities that allow local attackers to execute arbitrary code by planting malicious libraries in predictable…. A patch is available.

How to fix or mitigate EUVD-2026-20773?

Within 24 hours: Identify all systems running ufrisk MemProcFS and document current versions. Within 7 days: Upgrade to MemProcFS 5.17 or later on all affected systems. Within 30 days: Verify patch deployment across the environment and review local access controls to restrict working-directory write permissions where MemProcFS operates.

Memprocfs EUVD-2026-20773

Q: What is the CVSS score of EUVD-2026-20773?

EUVD-2026-20773 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-40031 HIGH

Uncontrolled Search Path Element (CWE-427)

2026-04-08 VulnCheck

GHSA-wxrw-fvc7-2xmx

RCE Memprocfs

8.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 16:22 vuln.today

cvss_changed

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20773

Analysis Generated

Apr 08, 2026 - 22:01 vuln.today

Patch released

Apr 08, 2026 - 22:01 nvd

Patch available

CVE Published

Apr 08, 2026 - 21:35 nvd

HIGH 8.5

DescriptionCVE.org

MemProcFS before 5.17 contains multiple unsafe library-loading patterns that enable DLL and shared-library hijacking across six attack surfaces, including bare-name LoadLibraryU and dlopen calls without path qualification for vmmpyc, libMSCompression, and plugin DLLs. An attacker who places a malicious DLL or shared library in the working directory or manipulates LD_LIBRARY_PATH can achieve arbitrary code execution when MemProcFS loads.

AnalysisAI

DLL and shared-library hijacking in ufrisk MemProcFS versions prior to 5.17 enables local arbitrary code execution through six distinct attack surfaces. Unsafe library-loading patterns-including unqualified LoadLibraryU and dlopen calls for vmmpyc, libMSCompression, and plugin DLLs-allow attackers to plant malicious libraries in the working directory or manipulate LD_LIBRARY_PATH. Exploitation requires user interaction (CVSS UI:P) but no authentication (PR:N), achieving high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis.

Technical ContextAI

CWE-427 (Uncontrolled Search Path Element) manifests through bare-name dynamic library loading without absolute paths. LoadLibraryU (Windows) and dlopen (Linux) calls fail to qualify library locations, enabling DLL preloading and LD_LIBRARY_PATH injection. Six distinct entry points (vmmpyc, libMSCompression, plugin system) multiply attack surface. Local attack vector (AV:L) with low complexity (AC:L) requires local file-system write access coinciding with MemProcFS execution.

RemediationAI

Vendor-released patch: upgrade to MemProcFS version 5.17 or later, available at https://github.com/ufrisk/MemProcFS/releases/tag/v5.17. The fix (commit df80e6e83641f5004025ce661e6dd8139028d7b5) implements fully-qualified library paths and hardened search-path logic. Until patching, mitigate by restricting write access to MemProcFS working directories, auditing LD_LIBRARY_PATH and PATH environment variables, and executing MemProcFS only from controlled directories with verified library contents. On multi-user systems, enforce directory permissions preventing untrusted users from planting libraries in shared paths. Consult vendor advisory at https://www.vulncheck.com/advisories/memprocfs-dll-shared-library-hijacking for additional platform-specific guidance.