What is CVE-2020-36937?

CVE-2020-36937 is a high-severity vulnerability in Microvirt Memu Play, classified under Unquoted Search Path or Element. CVSS score: 7.8/10. Published 2026-01-25.

How severe is CVE-2020-36937?

High severity. CVSS v3 base score is 7.8 out of 10.

Vulnerability in Microvirt Memu Play

CVE-2020-36937

Microvirt MEMU Play 3.7.0 contains an unquoted service path vulnerability in the MEmusvc Windows service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted binary path to inject malicious…

EPSS: 0.001 (2.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Microvirt Memu Play — versions 3.7.0

Weakness classification (CWE)

CWE-428 — Unquoted Search Path or Element

References

disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2020-36937?: CVE-2020-36937 is a high-severity vulnerability in Microvirt Memu Play, classified under Unquoted Search Path or Element. CVSS score: 7.8/10. Published 2026-01-25.
How severe is CVE-2020-36937?: High severity. CVSS v3 base score is 7.8 out of 10.