EUVD-2026-52346
GHSA-fw2f-f4jh-88rv
Severity by source
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack with low privilege required (PR:L); high complexity reflects DLL search path hijacking preconditions; scope changes to kernel (S:C) given mini-filter driver context.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security flaw has been discovered in CheckMAL AppCheck Pro 3.1.43.10. Affected is an unknown function in the library AppCheckD.sys of the component Kernel Mini-Filter Driver. Performing a manipulation results in uncontrolled search path. The attack requires a local approach. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Uncontrolled search path exploitation in CheckMAL AppCheck Pro 3.1.43.10's kernel mini-filter driver (AppCheckD.sys) allows a local attacker with low privileges to redirect the driver's library loading path, potentially achieving kernel-level code execution on the target host. A public proof-of-concept exploit has been released despite the vendor declining to respond to coordinated disclosure, making this a no-patch, public-exploit scenario. While high attack complexity (AC:H) reduces opportunistic risk, the complete confidentiality, integrity, and availability impact at the kernel layer makes successful exploitation highly damaging.
Technical ContextAI
CWE-427 (Uncontrolled Search Path Element) describes a class of vulnerability where a process - in this case a Windows kernel mini-filter driver - loads a resource (typically a DLL or module) from a filesystem path that an attacker can influence, such as a user-writable directory that precedes the intended path in the search order. AppCheckD.sys is a kernel-mode component of CheckMAL AppCheck Pro, an anti-ransomware security product targeting Windows. Because mini-filter drivers operate at kernel privilege level (Ring 0), any code successfully loaded by them inherits those privileges, making path hijacking in this context far more severe than equivalent flaws in user-mode applications. The CPE string cpe:2.3:a:checkmal:appcheck_pro:*:*:*:*:*:*:*:* uses a wildcard version field, suggesting NVD has not narrowed the affected version range beyond the specific version cited in the description (3.1.43.10).
RemediationAI
No vendor-released patch is available at time of analysis - CheckMAL did not respond to coordinated disclosure, and no fixed version has been identified. As a primary compensating control, restrict local user accounts to the minimum necessary privileges and audit writable directories that fall within the DLL search path of AppCheckD.sys; removing write permissions from non-admin users on directories such as system32, application installation folders, and PATH-included locations reduces hijacking opportunity, though this may affect legitimate software behavior. Disabling or uninstalling the AppCheck Pro kernel driver (AppCheckD.sys) eliminates the attack surface entirely but removes anti-ransomware protection - weigh this trade-off against the local-access prerequisite, which limits remote exploitation. Organizations should monitor the VulDB entry (https://vuldb.com/vuln/385528) and the vendor's release channel for any future patch. Application of Windows Defender Credential Guard and Driver Signature Enforcement policies may provide additional kernel-layer defense-in-depth. Consider replacing AppCheck Pro with an alternative endpoint security product that maintains active vulnerability disclosure response if no vendor patch materializes.
More in Appcheck Pro
View allSame weakness CWE-427 – Uncontrolled Search Path Element
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today