CVE-2026-18605 Overview
CVE-2026-18605 is an uncontrolled search path vulnerability [CWE-426] in CheckMAL AppCheck Pro 3.1.43.10. The flaw resides in an unspecified function of the AppCheckD.sys kernel mini-filter driver. A local attacker with low privileges can manipulate the driver's search path to influence which resources it loads at runtime. VulDB records that exploit code has been released publicly, though the attack complexity is high and exploitation is described as difficult. CheckMAL was contacted about the disclosure but did not respond.
Critical Impact
Successful exploitation targets a kernel-mode driver, giving an attacker with local access the potential to compromise the confidentiality, integrity, and availability of the affected host through a manipulated search path.
Affected Products
- CheckMAL AppCheck Pro 3.1.43.10
- Component: Kernel Mini-Filter Driver (AppCheckD.sys)
- Vendor: CheckMAL (no vendor response to disclosure)
Discovery Timeline
- 2026-08-03 - CVE-2026-18605 published to the National Vulnerability Database
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-18605
Vulnerability Analysis
The vulnerability affects AppCheckD.sys, a kernel mini-filter driver shipped with AppCheck Pro. Mini-filter drivers register with the Windows Filter Manager to intercept file system I/O operations, so they run in kernel mode and interact closely with the operating system loader.
The defect is categorized as an uncontrolled search path element. The driver or an associated component resolves a resource (such as a DLL, configuration file, or dependent module) using a search order that an attacker can influence. When a lower-privileged location precedes a trusted one in the lookup sequence, an attacker-controlled file can be loaded in place of the intended target.
The attack requires local access and low privileges, and the reported attack complexity is high. The exploit is public but described as difficult to weaponize reliably.
Root Cause
The root cause is improper control of how the mini-filter driver or its user-mode helpers resolve external resources. Under [CWE-426], the affected code trusts search locations that a non-privileged user can write to or influence, rather than binding resource resolution to a fully qualified, protected path.
Attack Vector
A local user places a crafted file in a directory that appears earlier in the driver's resolution order than the legitimate resource. When the driver or a privileged process it interacts with loads that resource, the attacker's file is used instead. Because the affected component executes in kernel context, a successful hijack can escalate the attacker's control over the host. Refer to the OpCodic Vulnerability Analysis Report for the researcher's technical breakdown.
Detection Methods for CVE-2026-18605
Indicators of Compromise
- Unexpected files matching common DLL or configuration names in directories writable by standard users along the AppCheck Pro load path.
- New or modified files in the AppCheck Pro install directory that are not signed by CheckMAL.
- Kernel-mode load events for AppCheckD.sys correlated with recent user-writable file creations.
Detection Strategies
- Hunt for image loads originating from AppCheckD.sys or associated user-mode services where the resolved path is outside the protected install directory.
- Alert on process creation and module load events where AppCheck Pro components load binaries from %TEMP%, %APPDATA%, or the current working directory.
- Baseline the expected file set for AppCheck Pro 3.1.43.10 and flag additions that do not match vendor-signed hashes.
Monitoring Recommendations
- Enable Windows Sysmon Event IDs 7 (Image Loaded) and 11 (File Create) with rules scoped to the AppCheck Pro directory.
- Forward driver load and file system telemetry to a centralized data lake for retroactive hunting once vendor guidance is available.
- Monitor for local privilege escalation patterns following any interaction with AppCheckD.sys.
How to Mitigate CVE-2026-18605
Immediate Actions Required
- Inventory endpoints running CheckMAL AppCheck Pro 3.1.43.10 and prioritize systems where untrusted local users have interactive access.
- Restrict write permissions on directories that appear in the search path of AppCheck Pro binaries and services.
- Limit local logon rights on affected hosts to reduce the population of users who can stage a hijack file.
Patch Information
At the time of publication, no vendor patch is referenced in the NVD entry, and CheckMAL did not respond to the disclosure. Track vendor communications and the VulDB CVE-2026-18605 entry for updates on a fixed build.
Workarounds
- Enforce application allowlisting so that only vendor-signed binaries can be loaded by AppCheck Pro components.
- Audit and tighten ACLs on the AppCheck Pro installation directory and any auxiliary paths consulted by AppCheckD.sys.
- Where operationally acceptable, remove AppCheck Pro 3.1.43.10 from high-risk multi-user systems until a fixed version is released.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
