Windows 0-day drops the same day Microsoft releases record number of patches
| Source: Ars Technica AI
Tags: Windows, Zero-day, HiveLegacy, Microsoft, Privilege Escalation, Cybersecurity
Researcher NightmareEclypse published HiveLegacy — a working Windows elevation-of-privilege exploit targeting the User Profile Service that lets low-privilege accounts modify admin registry hives and execute code when the admin logs in. No Microsoft patch exists yet.
Details
HiveLegacy exploits a flaw in how Windows loads a user's class registry hive at login. Because the user isn't yet authenticated at that point, Windows loads the hive under NT AUTHORITY\SYSTEM — a window that HiveLegacy exploits to let a low-privilege attacker plant code that runs with effective admin rights when the target administrator next logs in. The exploit requires the attacker to know credentials for any account on the machine plus the username of a third account (either can be non-admin). Security analyst Will Dormann of Tharros Labs confirmed the exploit works and called modifying an admin's class hive 'a pretty powerful primitive' that clever attackers can chain to achieve full administrator access, potentially without requiring any user interaction. Microsoft released a record number of patches on the same Patch Tuesday this zero-day dropped, but HiveLegacy has no fix yet. The company acknowledged awareness and is investigating while recommending coordinated disclosure. A detection script from independent researcher Kevin Robertson is available as a temporary mitigation. NightmareEclypse, who remains pseudonymous, has now published nine Windows zero-days, citing dissatisfaction with Microsoft's bug report handling. Enterprise teams running Windows should prioritize deploying the detection script until a patch arrives.