What’s Vulnerable › Vulnerabilities

CVE-2026-40031: MemProcFS < 5.17 DLL/Shared Library Hijacking

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-08 · updated 2026-07-24
• Weakness: CWE-427

Description

MemProcFS before 5.17 contains multiple unsafe library-loading patterns that enable DLL and shared-library hijacking across six attack surfaces, including bare-name LoadLibraryU and dlopen calls without path qualification for vmmpyc, libMSCompression, and plugin DLLs. An attacker who places a malicious DLL or shared library in the working directory or manipulates LD_LIBRARY_PATH can achieve arbitrary code execution when MemProcFS loads.

Affected products

• ufrisk MemProcFS: before 5.17 — fixed in 5.17

How to fix

Upgrade to a fixed version: ufrisk MemProcFS 5.17. Check the vendor advisory for mitigations.

References

• https://github.com/ufrisk/MemProcFS/commit/df80e6e83641f5004025ce661e6dd8139028d7b5
• https://github.com/ufrisk/MemProcFS/releases/tag/v5.17
• https://mobasi.ai/sentinel
• https://www.vulncheck.com/advisories/memprocfs-dll-shared-library-hijacking

Get alerted when CVE-2026-40031 or the next vulnerability affects your stack