CVE-2020-36937
Published: 25 January 2026
Summary
CVE-2020-36937 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Memuplay (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 2.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2020-36937 is an unquoted service path vulnerability affecting Microvirt MEMU Play version 3.7.0, specifically in the MEmusvc Windows service. The issue, classified under CWE-428, arises from the service's binary path not being properly quoted, enabling local attackers to potentially execute arbitrary code. It has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability.
Local attackers with low-privilege user access (PR:L) can exploit this vulnerability by placing a malicious executable in a directory preceding the legitimate service binary in the system's search path. When the MEmusvc service starts or restarts, Windows will execute the attacker's malicious binary instead, running it with elevated LocalSystem privileges and potentially leading to full system compromise.
Advisories and related resources, including a Vulncheck advisory on the MEmusvc unquoted service path, an Exploit-DB entry with exploit details, and the official MEMU Play website, provide further technical analysis. Practitioners should consult these for exploitation proofs and potential vendor guidance on remediation.
A proof-of-concept exploit is publicly available on Exploit-DB, highlighting the vulnerability's practicality for local privilege escalation in affected environments.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4636
Vulnerability details
Microvirt MEMU Play 3.7.0 contains an unquoted service path vulnerability in the MEmusvc Windows service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted binary path to inject malicious executables that will be run with…
more
elevated LocalSystem privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct match to unquoted service path enabling path interception for local privilege escalation via malicious binary placement.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Establishes and enforces secure configuration settings for services, including properly quoting binary paths to directly prevent exploitation of unquoted service path vulnerabilities like CVE-2020-36937.
Requires timely identification, reporting, and remediation of flaws such as the unquoted service path in MEmusvc, preventing local privilege escalation via patches or configuration corrections.
Conducts vulnerability scanning that identifies unquoted service path issues like CVE-2020-36937, enabling remediation before local attackers can exploit for LocalSystem privilege escalation.