SF-LABS-2026-02 / BLANK CHECK / Vulnerability Disclosure

BLANK CHECK Local Privilege Escalation in a Major Windows Desktop Accounting Application

Reported, awaiting vendor acknowledgement

A standard, non-administrator user can gain full SYSTEM control of any Windows machine running the affected application, with no admin rights, no reboot and no user interaction. Confirmed on the current, fully-updated release. Reported to the vendor through a coordinated channel. Full details and proof-of-concept follow once the disclosure window closes.

Demonstration

Proof-of-Concept Video

Video proof-of-concept will be added when available. The recording shows the escalation path end-to-end, from the unprivileged-user starting state to the SYSTEM shell that results.

Disclosure Record

Timeline and Affected Surface

Advisory ID: SF-LABS-2026-02
Codename: BLANK CHECK
Vendor: Undisclosed - vendor withheld at the vendor's request
Product: Major Windows desktop accounting application (current shipping release, fully updated)
Vulnerability class: Local privilege escalation to SYSTEM
Discovery date: 2026-06-12
Vendor notified: 2026-06-12
Vendor acknowledged: Awaiting acknowledgement
CVE ID: CVE: being pursued via independent coordination
Affected versions: Withheld at the vendor's request
Researcher: Ryan Purita, Principal Security Consultant, Sherlock Forensics
Methodology: Original research by Sherlock Forensics Labs

Sherlock Forensics adheres to coordinated disclosure timelines. Technical specifics, proof-of-concept code and remediation guidance are withheld at the vendor's request. We do not publish details that could enable exploitation while affected users remain vulnerable.

Public Summary

What is Publicly Disclosed Now

SF-LABS-2026-02 BLANK CHECK is a local privilege escalation in an undisclosed major Windows desktop accounting application confirmed on the current shipping release with all updates applied. The exploit requires the attacker to already have code execution in a standard non-administrator user context on the target machine. That foothold is the routine outcome of phishing, drive-by download or commodity malware. BLANK CHECK converts any such standard-user foothold into SYSTEM on a fully patched endpoint running affected versions of the application.

Defensive recommendations for the embargo period are limited to standard local-attack-surface hardening: enforce least-privilege user accounts, restrict execution of unsigned or untrusted binaries from user-writable locations and review installed-software inventory against the public affected-versions list once it lands.

Sherlock Forensics will not publish further technical detail. This advisory is held in un-named form at the vendor's request. Researchers and incident response teams who need pre-release notification under NDA can reach the lab at labs@sherlockforensics.com.

About

About Sherlock Forensics Labs

Sherlock Forensics Labs is the research arm of Sherlock Forensics, a Vancouver BC based digital forensics and cybersecurity practice. Lead researcher Ryan Purita is a Principal Security Consultant with 20 years of courtroom-tested digital forensics work plus CISSP, ISSAP and ISSMP certification. The lab follows coordinated disclosure with vendor-acknowledged release provisions. See the Labs hub for active and archived disclosures.