AppCheck Pro (3.1.43.10) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/appcheck-pro-3.1.43.10/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 03 Aug 2026 18:05:54 +0000Local Privilege Escalation in CheckMAL AppCheck Pro via Kernel Driverhttps://feed.craftedsignal.io/briefs/2026-08-checkmal-appcheck-privesc/Mon, 03 Aug 2026 18:05:54 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-checkmal-appcheck-privesc/A local privilege escalation vulnerability in the AppCheckD.sys driver of CheckMAL AppCheck Pro version 3.1.43.10 allows attackers to perform uncontrolled search path manipulation.A security vulnerability has been identified in CheckMAL AppCheck Pro version 3.1.43.10 involving an unknown function within the AppCheckD.sys kernel mini-filter driver. This flaw enables an attacker with local access to conduct an uncontrolled search path manipulation, potentially leading to unauthorized privilege escalation. While the vulnerability is reported as complex to exploit, a public exploit exists, increasing the risk for environments where this security software is deployed. CheckMAL has reportedly remained unresponsive to disclosure attempts, leaving the vulnerability unpatched in the specified version. Security teams should assess the presence of AppCheck Pro in their environment and monitor for local activities involving the driver.

Impact

Successful exploitation of this vulnerability allows a local attacker to execute arbitrary code with kernel-level privileges. This facilitates a complete compromise of the affected host, enabling persistence, data exfiltration, and bypass of installed security controls. Given the nature of the software as a security product, its compromise undermines the integrity of the host's defensive posture.

Recommendation

  1. Inventory all endpoints running CheckMAL AppCheck Pro 3.1.43.10 to identify exposure.
  2. Restrict non-administrator local access to systems running this software to mitigate the local exploit vector.
  3. Monitor for unusual process execution or file modifications involving the AppCheckD.sys driver or associated application directories.
  4. Consider alternative security solutions if the vendor continues to provide no patch for this critical-impact driver vulnerability.
]]>highadvisoryprivilege-escalationwindowskernel-driver