CVE-2026-40031

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40031", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-04-08T13:36:52.082Z", "datePublished": "2026-04-08T21:35:26.293Z", "dateUpdated": "2026-11-08T14:02:43.407Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:02:43.407Z"}, "datePublic": "2026-01-28T00:00:00.000Z", "title": "MemProcFS < 5.17 DLL/Shared Library Hijacking", "descriptions": [{"lang": "en", "value": "MemProcFS before 5.17 contains multiple unsafe library-loading patterns that enable DLL and shared-library hijacking across six attack surfaces, including bare-name LoadLibraryU and dlopen calls without path qualification for vmmpyc, libMSCompression, and plugin DLLs. An attacker who places a malicious DLL or shared library in the working directory or manipulates LD_LIBRARY_PATH can achieve arbitrary code execution when MemProcFS loads."}], "tags": ["x_open-source"], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-427", "description": "Uncontrolled Search Path Element", "type": "CWE"}]}], "affected": [{"vendor": "ufrisk", "product": "MemProcFS", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.16.12", "versionType": "semver"}, {"version": "5.17.0", "status": "unaffected", "versionType": "semver"}, {"status": "unaffected", "version": "df80e6e83641f5004025ce661e6dd8139028d7b5", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:ufrisk:memprocfs:*:*:*:*:*:*:*:*", "versionEndIncluding": "5.16.12"}]}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.5, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}}], "references": [{"url": "https://github.com/ufrisk/MemProcFS/releases/tag/v5.17", "name": "MemProcFS 5.17 Release Notes", "tags": ["product", "release-notes"]}, {"url": "https://github.com/ufrisk/MemProcFS/commit/df80e6e83641f5004025ce661e6dd8139028d7b5", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://mobasi.ai/sentinel", "name": "Mobasi Sentinel Vulnerability Index", "tags": ["vendor-advisory"]}, {"name": "VulnCheck Advisory: MemProcFS < 5.17 DLL/Shared Library Hijacking", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/memprocfs-dll-shared-library-hijacking"}], "credits": [{"lang": "en", "value": "Mobasi Security Team", "type": "finder"}], "x_generator": {"engine": "vulncheck"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-09T14:49:50.491567Z", "id": "CVE-2026-40031", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-09T16:16:34.107Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40031", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-09T14:49:50.491567Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-09T14:49:56.291Z"}}], "cna": {"tags": ["x_open-source"], "title": "MemProcFS < 5.17 DLL/Shared Library Hijacking", "credits": [{"lang": "en", "type": "finder", "value": "Mobasi Security Team"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ufrisk", "product": "MemProcFS", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.16.12"}, {"status": "unaffected", "version": "5.17.0", "versionType": "semver"}, {"status": "unaffected", "version": "df80e6e83641f5004025ce661e6dd8139028d7b5", "versionType": "git"}], "defaultStatus": "unaffected"}], "datePublic": "2026-01-28T00:00:00.000Z", "references": [{"url": "https://github.com/ufrisk/MemProcFS/releases/tag/v5.17", "name": "MemProcFS 5.17 Release Notes", "tags": ["product", "release-notes"]}, {"url": "https://github.com/ufrisk/MemProcFS/commit/df80e6e83641f5004025ce661e6dd8139028d7b5", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://mobasi.ai/sentinel", "name": "Mobasi Sentinel Vulnerability Index", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/memprocfs-dll-shared-library-hijacking", "name": "VulnCheck Advisory: MemProcFS < 5.17 DLL/Shared Library Hijacking", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "MemProcFS before 5.17 contains multiple unsafe library-loading patterns that enable DLL and shared-library hijacking across six attack surfaces, including bare-name LoadLibraryU and dlopen calls without path qualification for vmmpyc, libMSCompression, and plugin DLLs. An attacker who places a malicious DLL or shared library in the working directory or manipulates LD_LIBRARY_PATH can achieve arbitrary code execution when MemProcFS loads."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-427", "description": "Uncontrolled Search Path Element"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ufrisk:memprocfs:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "5.16.12"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:02:43.407Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40031", "state": "PUBLISHED", "dateUpdated": "2026-11-08T14:02:43.407Z", "dateReserved": "2026-04-08T13:36:52.082Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-04-08T21:35:26.293Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "MemProcFS", "vendor": "ufrisk", "versions": [{"lessThanOrEqual": "5.16.12", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "5.17.0", "versionType": "semver"}, {"status": "unaffected", "version": "df80e6e83641f5004025ce661e6dd8139028d7b5", "versionType": "git"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ufrisk:memprocfs:*:*:*:*:*:*:*:*", "matchCriteriaId": "B95245AF-723F-4F9F-8EC2-21508A16EBCB", "versionEndExcluding": "5.17", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MemProcFS before 5.17 contains multiple unsafe library-loading patterns that enable DLL and shared-library hijacking across six attack surfaces, including bare-name LoadLibraryU and dlopen calls without path qualification for vmmpyc, libMSCompression, and plugin DLLs. An attacker who places a malicious DLL or shared library in the working directory or manipulates LD_LIBRARY_PATH can achieve arbitrary code execution when MemProcFS loads."}, {"lang": "es", "value": "MemProcFS anterior a la versi\u00f3n 5.17 contiene m\u00faltiples patrones inseguros de carga de bibliotecas que permiten el secuestro de DLL y bibliotecas compartidas a trav\u00e9s de seis superficies de ataque, incluyendo llamadas a LoadLibraryU y dlopen sin calificaci\u00f3n de ruta para vmmpyc, libMSCompression y DLL de plugins. Un atacante que coloca una DLL o biblioteca compartida maliciosa en el directorio de trabajo o manipula LD_LIBRARY_PATH puede lograr ejecuci\u00f3n de c\u00f3digo arbitrario cuando MemProcFS se carga."}], "id": "CVE-2026-40031", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40031", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-09T14:49:50.491567Z", "version": "2.0.3"}}]}, "published": "2026-04-08T22:16:23.650", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Patch"], "url": "https://github.com/ufrisk/MemProcFS/commit/df80e6e83641f5004025ce661e6dd8139028d7b5"}, {"source": "disclosure@vulncheck.com", "tags": ["Product"], "url": "https://github.com/ufrisk/MemProcFS/releases/tag/v5.17"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://mobasi.ai/sentinel"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/memprocfs-dll-shared-library-hijacking"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,5.16.12]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "5.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "code_commit", "value": "df80e6e83641f5004025ce661e6dd8139028d7b5"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "MemProcFS", "source": "cna", "vendor": "ufrisk"}, "product": "memprocfs", "vendor": "ufrisk"}], "analysis": {"en": {"generated_at": "2026-04-08T22:23:00.516203+00:00", "value": {"mitigation_remediation": ["Upgrade MemProcFS to version 5.17 or later to eliminate unsafe library loading paths.", "If an upgrade cannot be applied immediately, ensure that MemProcFS is launched from a secure, non\u2011writable working directory that cannot be modified by untrusted users.", "Unset or restrict LD_LIBRARY_PATH before starting MemProcFS so it cannot locate malicious libraries in user\u2011controlled locations.", "Audit the system for unauthorized DLL or shared library loads and apply additional monitoring or access controls as needed.", "Regularly check the vendor\u2019s website and security advisories for updates or patches relating to this issue."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the ufrisk MemProcFS product installed on any operating system using versions prior to 5.17. Users who run older releases and provide untrusted working directories or environment variables are susceptible.", "description_and_impact": "MemProcFS versions earlier than 5.17 load libraries without full path qualification, allowing attackers to hijack DLL and shared library loads. By placing a malicious file with the expected name in the working directory or by manipulating LD_LIBRARY_PATH, an attacker can cause MemProcFS to load that file instead of the legitimate library. This results in arbitrary code execution within the MemProcFS process, granting the attacker full control over the application and potentially the host system. The weakness is identified as CWE\u2011427, reflecting insecure handling of executable paths.", "risk_and_exploitability": "With a CVSS score of 8.5, this flaw is classified as high severity. Although no exploit probability score is available and the vulnerability is not listed in CISA\u2019s KEV catalog, the attack can be performed locally by anyone who can write to the MemProcFS working directory or influence environment variables such as LD_LIBRARY_PATH. If MemProcFS runs with elevated privileges, an attacker can gain system-level access through this vector."}}}}, "created": "2026-04-09T08:16:25.552505+00:00", "updated": "2026-04-09T08:25:51.539939+00:00", "vendors": ["ufrisk", "ufrisk$PRODUCT$memprocfs"]}