MemProcFS versions earlier than 5.17 load libraries without full path qualification, allowing attackers to hijack DLL and shared library loads. By placing a malicious file with the expected name in the working directory or by manipulating LD_LIBRARY_PATH, an attacker can cause MemProcFS to load that file instead of the legitimate library. This results in arbitrary code execution within the MemProcFS process, granting the attacker full control over the application and potentially the host system. The weakness is identified as CWE‑427, reflecting insecure handling of executable paths.

The vulnerability affects the ufrisk MemProcFS product installed on any operating system using versions prior to 5.17. Users who run older releases and provide untrusted working directories or environment variables are susceptible.

With a CVSS score of 8.5, this flaw is classified as high severity. Although no exploit probability score is available and the vulnerability is not listed in CISA’s KEV catalog, the attack can be performed locally by anyone who can write to the MemProcFS working directory or influence environment variables such as LD_LIBRARY_PATH. If MemProcFS runs with elevated privileges, an attacker can gain system-level access through this vector.