MEmu Play Privilege Escalation Vulnerability via Insecure File Permissions

A privilege escalation vulnerability has been identified in MEmu Play version 6.0.7. This issue arises from insecure file permissions that allow low-privilege users to replace the MemuService.exe executable with a malicious file. The replaced executable is executed with system-level privileges when the service is restarted after a computer reboot.

Impact

Exploitation of this vulnerability allows for unauthorized privilege escalation, with the malicious executable running under the Local System account, granting elevated rights on the affected machine.

Reproduction

To reproduce this vulnerability, a low-privilege user must rename the original MemuService.exe file and replace it with a malicious executable. After overwriting the file, the user can restart the computer, which triggers the execution of the malicious file with system-level privileges.