CVE-2026-40031

MemProcFS versions before 5.17 contain critical insecure library-loading vulnerabilities across six attack surfaces that enable DLL and shared-library hijacking. The flaw stems from unsafe patterns including bare-name LoadLibraryU and dlopen calls without proper path qualification for vmmpyc, libMSCompression, and plugin DLLs. An attacker can place malicious libraries in the working directory or manipulate LD_LIBRARY_PATH to achieve arbitrary code execution when MemProcFS loads. The vulnerability carries a CVSS score of 7.8 (HIGH) with a local attack vector requiring minimal complexity and no privilege escalation. Impact is severe across all dimensions: confidentiality, integrity, and availability are all compromised with high severity. User interaction is required, suggesting the attack surface is limited to scenarios where users launch MemProcFS from untrusted or shared directories. There is currently no evidence of active exploitation or public exploit code availability, as reflected by the vulnerability's absence from the CISA Known Exploited Vulnerabilities catalog and its inactive status on vulnerability tracking lists. The EPSS score of 0.00015 indicates exceptionally low probability of exploitation relative to other known vulnerabilities, suggesting community attention remains minimal. Organizations should prioritize updating to version 5.17 or later as a preventive measure rather than in response to active threats.