MemProcFS versions prior to 5.17 contain multiple unsafe library-loading vulnerabilities that allow an attacker to achieve arbitrary code execution via DLL hijacking.

This vulnerability involves uncontrolled search path elements (CWE-427) where the application uses insecure library-loading calls, such as bare-name LoadLibraryU and dlopen, without path qualification. An attacker can exploit this by placing a malicious library in the working directory or manipulating environment variables to execute arbitrary code when the application initiates a load.

The ability to execute arbitrary code on a system running MemProcFS presents a severe security risk, as it allows for full system compromise, data exfiltration, or the installation of persistent malware. While the CVSS score of 7.8 indicates a high severity, the local attack vector and user interaction requirement slightly temper the immediate risk compared to a remote exploit. Nevertheless, the potential for total impact on system confidentiality, integrity, and availability necessitates prompt remediation.

Immediate Action: Update MemProcFS to version 5.17.0 or later, which includes the necessary security fixes and path qualification changes.

Proactive Monitoring: Monitor system logs for unauthorized DLL loading events or unexpected processes spawning from the MemProcFS directory.

Compensating Controls: Ensure that the application is executed from a secure, read-only directory to prevent attackers from placing malicious libraries in the working path.

Public Exploit Available: Unknown.

Given the potential for arbitrary code execution, this vulnerability poses a significant risk to affected environments. Administrators should prioritize updating to version 5.17.0 immediately to eliminate the underlying library-loading flaws. Failure to patch leaves systems vulnerable to local privilege escalation and full system compromise if an attacker gains control over the local execution environment.