SF-LABS-2026-04 / PARTY LINE / Vulnerability Disclosure

Brother iPrint&Scan for Windows PARTY LINE Missing Authorization

Vendor report in preparation

Awaiting vendor acknowledgement

Sherlock Forensics Labs identified a local privilege escalation weakness in Brother iPrint&Scan for Windows. A non-administrative local user can reach interfaces intended for trusted callers, with potential impact on service availability and stored configuration exposure. Vendor report is in preparation. Full technical write-up follows when the disclosure window closes.

Disclosure Record

Timeline and Affected Surface

Advisory ID: SF-LABS-2026-04
Codename: PARTY LINE
Vendor: Brother
Product: Brother iPrint&Scan for Windows (current shipping release)
Vulnerability class: Local privilege escalation (Missing Authorization)
Discovery date: 2026-06-15
Vendor notified: Coordinated vendor report in preparation
Vendor acknowledged: Awaiting acknowledgement
90-day expiry: Computed from acknowledgement date when received
CVE ID: Pending. Coordinated vendor report in preparation, Brother PSIRT
Affected versions: Disclosed when the disclosure window closes
Researcher: Ryan Purita, Principal Security Consultant, Sherlock Forensics
Methodology: Original research by Sherlock Forensics Labs, surfaced during authorized own-host research using the Sherlock EoP Auditor

Sherlock Forensics adheres to coordinated disclosure timelines. Technical specifics, proof-of-concept code and remediation guidance will be published when the disclosure window closes or earlier with vendor approval. We do not publish details that could enable exploitation while affected users remain vulnerable.

Public Summary

What is Publicly Disclosed Now

Sherlock Forensics Labs identified a local privilege escalation weakness in Brother iPrint&Scan for Windows affecting the current shipping release. Components running in an elevated context accept actions from unprivileged callers without proper authorization checks. A non-administrative local user can reach interfaces intended for trusted callers, with potential impact on service availability and stored configuration exposure.

Full privilege impact remains under measured assessment. Sherlock Forensics is characterizing the finding conservatively and will not publish exploitation detail while the disclosure is active.

The weakness was confirmed present and unremediated in the latest available version of the product at the time of writing, with no vendor fix currently available. The finding was surfaced during authorized own-host research using the Sherlock EoP Auditor, the lab's Windows privilege-escalation surface scanner. All testing was conducted on systems owned and controlled by the researcher under authorized conditions. No third-party client or production environments were involved.

Sherlock Forensics will publish full technical detail when the disclosure window closes or earlier on vendor approval. Researchers and incident response teams who need pre-release notification under NDA can reach the lab at labs@sherlockforensics.com.

About

About Sherlock Forensics Labs

Sherlock Forensics Labs is the research arm of Sherlock Forensics, a Vancouver BC based digital forensics and cybersecurity practice. Lead researcher Ryan Purita is a Principal Security Consultant with 20 years of courtroom-tested digital forensics work plus CISSP, ISSAP and ISSMP certification. The lab follows industry-standard 90-day coordinated disclosure with vendor-acknowledged early-release provisions. See the Labs hub for active and archived disclosures.