CVE-2026-36213: An issue in Microvirt MEmu Android Emulator 9

Synopsis

A privilege escalation vulnerability affects Microvirt MEmu Android Emulator version 9.2.7.0 via its MemuService.exe component. The attacker requires only a low-privilege local account and no network access to trigger the flaw. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability on the affected host. No fix version has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to attempt the exploit; no elevated or administrative credentials are needed.

• Victim interactionNot required

  No user interaction is required; the attacker can execute the attack entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• A successful attacker reads all data accessible on the host, including credentials, session tokens, and application files stored by MEmu or co-located software.
• A successful attacker modifies or deletes files, configuration, and persisted application data on the host.
• A successful attacker crashes or permanently disrupts services running on the host, including MemuService.exe and any dependent processes.
• Because the escalation reaches a high privilege level, the attacker can install backdoors or alter system binaries to maintain persistent access.