Researcher drops unpatched Windows privilege-escalation zero-day right after Patch Tuesday

Less than an hour after Microsoft's July Patch Tuesday, the researcher known as Nightmare Eclipse published a proof-of-concept for LegacyHive, a Windows privilege-escalation flaw that works on fully updated systems. It abuses the Windows User Profile Service to let a standard user load another user's registry hive, including an administrator's, into their own profile, a useful stepping stone for an attacker who already has a foothold. There is no CVE, advisory, or patch. The public proof-of-concept was deliberately stripped down, needing extra credentials, but the researcher says the original had no such limits. Given this researcher's flaws have been weaponized quickly before, defenders should not wait for a fix.

Check

Since there is no patch, limit who can create local standard-user accounts, and monitor the Windows User Profile Service for unexpected registry hive loads and access to NTUSER.DAT and UsrClass.dat files.

Affected

Fully patched Windows desktops and servers; an attacker with a standard-user foothold and credentials can use LegacyHive to load another user's registry hive and help escalate privileges, with no fix yet.

Fix

Apply Microsoft's fix as soon as it ships, and until then restrict local account creation, watch for suspicious profile-service and registry activity, and validate the proof-of-concept only in isolated test environments.