from beep@piefed.world to cybersecurity@infosec.pub on 15 Jul 10:55
https://piefed.world/c/cybersecurity/p/1263200/nightmare-eclipse-just-dropped-legacyhive-a-new-windows-privilege-escalation-zero-day-po
cross-posted from: piefed.world/…/nightmare-eclipse-just-dropped-leg…
The PoC reportedly uses a carefully timed path-switching trick to make Windows mount another user’s Registry file, potentially an administrator’s, under a standard “helper” account.
Nightmare-Eclipse claims it works across supported Windows desktop and server builds patched through July 2026.
Nightmare-Eclipse says a private version could load arbitrary Registry hives, but that broader version has not been published.
Interestingly, Nightmare-Eclipse previously told us that vulnerability names are inspired by random events in his life. “LegacyHive” appears to break from that convention.
Deja vu: Microsoft patched this broad ProfSvc trust-boundary failure in 2015 as CVE-2015-0004, which also loaded another user’s hive. LegacyHive appears to use a new path-swap to revive that bug class.
As of writing: no CVE, no Microsoft advisory, no comment.
Text source: International Cyber Digest.
threaded - newest