CVE-2026-18605 is a high severity (CVSS 7.0) uncontrolled search path flaw in the AppCheckD.sys kernel mini-filter driver of CheckMAL AppCheck Pro 3.1.43.10. It needs local access. VulDB says the vendor did not respond to disclosure, so no fix is confirmed. Reduce local access and monitor for vendor updates.
What's affected
The record names CheckMAL AppCheck Pro 3.1.43.10 and the library AppCheckD.sys in the Kernel Mini-Filter Driver component. No CPE product data is attached to the record, so some scanners may not match it.
The record says the attack requires local access, has high complexity and that exploitation is described as difficult. It also says an exploit has been published. VulDB, the source of the record, states the vendor was contacted early but did not respond in any way. We could not load the VulDB or research pages, so we cannot confirm any fixed version. Check the vendor's site for a newer AppCheck Pro build.
KEV status is false, so there is no confirmed exploitation in the wild beyond the public disclosure noted.
How to check if you're exposed
List machines that run AppCheck Pro. Endpoint management tools can search installed programs for the product name. On a single Windows machine, the installed version is under Apps in Settings.
Check for the driver, which loads as a kernel component. Administrators can list loaded filter drivers with:
fltmc filters
Look for an entry related to AppCheck. Then look at who has local access on these machines, since the issue needs a local foothold.
What to do now
- Inventory machines with AppCheck Pro 3.1.43.10.
- Check the vendor's site for a newer release and apply it if one exists.
- If no fix exists, weigh whether you need the product on sensitive machines, and consider removing it.
- Limit local logon rights, and keep standard users off servers that run the software.
- Use application control to prevent unsigned code from loading from writable paths.
- Watch your endpoint tooling for unexpected driver loads.
Why it matters
The weakness classes are CWE-426 (untrusted search path) and CWE-427 (uncontrolled search path element). Software that looks for a file or library in a place a user can write may load a file that an attacker put there instead of the intended one. In a kernel component the loaded code runs with the highest rights on the machine.
The local attack vector and high complexity limit who can use the flaw, which is why the score is 7.0. But the combination of a kernel driver and a vendor that has not answered is uncomfortable, because defenders cannot count on a patch. The usual response is to cut exposure: fewer local users, tighter control of writable paths, and removal of software that is not needed.
Quick check
Is there a fix?
We could not confirm one. VulDB says the vendor did not respond, so check the vendor site for a newer build.
Is it exploited in the wild?
The KEV flag is false. The record says an exploit has been released publicly, which is a different thing.
Sources
Last reviewed: 18 October 2026.
