PT-2026-31468 · Ufrisk · Memprocfs

Published 2026-04-08 · Updated 2026-04-08 · CVE-2026-40031

NVD

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

MemProcFS before 5.17 contains multiple unsafe library-loading patterns that enable DLL and shared-library hijacking across six attack surfaces, including bare-name LoadLibraryU and dlopen calls without path qualification for vmmpyc, libMSCompression, and plugin DLLs. An attacker who places a malicious DLL or shared library in the working directory or manipulates LD LIBRARY PATH can achieve arbitrary code execution when MemProcFS loads.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2026-40031

Affected Products

Memprocfs

References · 5

• https://github.com/ufrisk/MemProcFS/commit/df80e6e83641f5004025ce661e6dd8139028d7b5 · Patch
• https://mobasi.ai/sentinel · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40031 · Security Note
• https://github.com/ufrisk/MemProcFS/releases/tag/v5.17 · Note
• https://vulncheck.com/advisories/memprocfs-dll-shared-library-hijacking · Note