| عنوان | CheckMAL AppCheck Pro 3.1.43.10 Creation of Temporary File in Directory with Insecure Permission |
|---|
| الوصف | A configuration-dependent local privilege escalation issue was identified in CheckMAL AppCheck Pro x.x.x.x on Windows. The issue affects the interaction between AppCheckD.sys and the RansomShelter virtual filesystem. When AppCheck file protection is configured to handle DLL files and self-protection is disabled, insufficient reparse point/junction validation may allow a low-privileged local attacker to redirect privileged file creation into the AppCheck installation directory.
This behavior can be abused to place an attacker-controlled proxy DLL, such as version.dll, into a directory used by AppCheck executables or services. After the affected component is restarted, the crafted DLL is loaded by a privileged AppCheck process, leading to arbitrary code execution as NT AUTHORITY\SYSTEM.
The vulnerability requires local access and specific product configuration conditions. It was reproduced on Windows 11 with AppCheck Pro 3.1.43.10.
The issue was reported to the vendor around April 2026, but no response had been received at the time of this submission.
|
|---|
| المصدر | ⚠️ https://opcodic.notion.site/AppCheck-Pro-Vulnerability-Analysis-Report-2f48e7fec518803e8e7fe18e71d77dac?pvs=74 |
|---|
| المستخدم | opcodic (UID 98850) |
|---|
| ارسال | 09/06/2026 12:47 AM (2 أشهر منذ) |
|---|
| الاعتدال | 03/08/2026 09:07 AM (2 months later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 385528 [CheckMAL AppCheck Pro 3.1.43.10 Kernel Mini-Filter Driver AppCheckD.sys تجاوز الصلاحيات] |
|---|
| النقاط | 17 |
|---|