CVE-2026-40031
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
MemProcFS before 5.17 has multiple unsafe library-loading patterns enabling DLL and shared-library hijacking across six attack surfaces. An attacker can place a malicious library in the working directory or manipulate LD_LIBRARY_PATH to achieve arbitrary code execution.
Risk Assessment
An attacker could achieve remote code execution in the context of the MemProcFS process, potentially leading to privilege escalation and system compromise.
Recommendation
Update MemProcFS to version 5.17 or later. Avoid running MemProcFS from untrusted working directories.
Related vulnerabilities
- CVE-2026-90558Critical
sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-byte buffer limit. Attackers can craft malicious SIP packets with oversized Call-ID, X-Call-ID, or other header fields to overflow stack buffers and cause crashes or execute arbitrary code during packet parsing and rendering.
- CVE-2026-78159Critical
The Events Calendar plugin for WordPress in all versions up to and including 6.17.3 is vulnerable to Remote Code Execution via the parse_array function. Insufficient validation of the widget 'classes' map allows a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This enables unauthenticated attackers to execute code on the server, provided comments are enabled on tribe_events posts and at least one comment containing a crafted wp:legacy-widget block has been submitted.
- CVE-2026-78006Critical
The Events Calendar plugin for WordPress in all versions up to and including 6.17.4 is vulnerable to Remote Code Execution via the is_safe_widget_instance function. Insufficient protection in is_safe_widget_instance can be bypassed because PHP fires magic methods during its pre-parse, combined with enable_rendering_widget_copied() forging a valid wp_hash integrity attribute before unserialize() is reached. This enables unauthenticated attackers to execute code on the server, as the plugin's V2 single-event template runs do_blocks() over buffered comment HTML and WordPress returns a moderation-hash URL allowing an unauthenticated commenter to immediately view their own pending comment.
- CVE-2026-85681Critical
The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated attackers to overwrite any of the site's options. On a single site installation this leads to a full takeover, as registration can be enabled with a default role of administrator.
- CVE-2026-84171Critical
The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory, allowing unauthenticated attackers to upload arbitrary files and execute arbitrary code on the server.
- CVE-2026-82845Critical
The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the plugin, write and execute arbitrary code on the server. A weaker form of the same issue is reachable without an account and yields an arbitrary file write rather than code execution.
- CVE-2026-81402Critical
The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability check, nonce verification, or file-type validation on its image upload handler, allowing unauthenticated attackers to upload arbitrary files, including PHP, to a web-accessible directory, which can lead to remote code execution.
- CVE-2026-77006Critical
The WebTotem Backups WordPress plugin through 1.0.1 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a site takeover.
- CVE-2026-77005Critical
The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a user-supplied file path before deleting a file, and does not check the capability of the user making the request, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a site takeover.
- CVE-2026-75800Critical
The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML authentication responses before establishing a session, allowing unauthenticated attackers to log in as any user, including administrators, as well as to create arbitrary accounts.
Original NVD description (English source)
MemProcFS before 5.17 contains multiple unsafe library-loading patterns that enable DLL and shared-library hijacking across six attack surfaces, including bare-name LoadLibraryU and dlopen calls without path qualification for vmmpyc, libMSCompression, and plugin DLLs. An attacker who places a malicious DLL or shared library in the working directory or manipulates LD_LIBRARY_PATH can achieve arbitrary code execution when MemProcFS loads.