CVE Intelligence
Analysis AI-assisted

CVE-2020-37129: Memu Play insecure folder permissions in MemuService.exe (CWE-276)

Memu Play 7.1.3 is reported to have insecure folder permissions that let low-privileged users modify the MemuService.exe service executable. The record links this weakness to privilege escalation to SYSTEM and gives a CNA-provided CVSS 3.1 base score of 9.8. No confirmed exploitation appears in the sources consulted, and the record lists no fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Memu Play 7.1.3 is reported to contain an insecure folder permissions weakness classified as CWE-276 (Incorrect Default Permissions). The weakness affects the MemuService.exe service executable, which low-privileged users can modify according to the record. The product home page is Memu Play.

Impact

  • The record describes a path to SYSTEM-level privileges through unrestricted file modification permissions on the service executable.
  • The record lists a CVSS 3.1 base score of 9.8 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, provided by the CNA.
  • The same provider also lists a CVSS 4.0 score of 8.5.

Affected products and versions

  • The description names Memu Play 7.1.3.
  • The record's affected list is empty, so the full range of affected versions is unknown.
  • The record lists no fixed version. This does not mean no fix exists, only that the record does not state one.

Exploitation status

  • The record shows this CVE is not listed in the CISA KEV catalog, so active exploitation is not confirmed by that source.
  • No confirmed exploitation appears in the sources consulted.
  • An Exploit-DB entry is referenced in the record. Its contents were not analyzed for this summary.
  • No EPSS score is available in the record.

Remediation and mitigation

  • Confirm whether Memu Play is installed on your endpoints and identify the installed version.
  • Check the vendor site for an updated release and apply it once its fix is verified.
  • Until a fix is confirmed, consider removing the product from systems where it is not required.
  • Restrict write access to the installation directory and the service executable so that only administrators can modify them.
  • Give priority to shared machines where users with limited accounts can log on.

Detection guidance

  • Audit access control lists on the MemuService.exe file and its parent folders for write rights granted to non-administrative groups.
  • Monitor for unexpected changes to service binaries, including modification time and hash changes.
  • Review Windows service configurations for services that point to unexpected binaries, and review service restart events.

Limitations of the available information

  • The record does not list affected or fixed versions, so the scope of exposure and remediation status are unknown.
  • The CVSS scores come from the CNA listed in the record. No other provider score is included.
  • No EPSS or SSVC data is present.
  • This analysis is based only on the record and the references it lists.

Frequently asked questions

What does CVE-2020-37129 affect?

The record describes Memu Play 7.1.3, where insecure folder permissions allow low-privileged users to modify the MemuService.exe service executable. The record does not list other affected versions.

Is there a fixed version or confirmed exploitation?

The record lists no fixed version and is not listed in CISA KEV. No confirmed exploitation appears in the sources consulted, so check the vendor site and your own environment for current status.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.