Full Report
Vexed researcher Nightmare-Eclipse (aka Chaotic Eclipse, Dead Eclipse, and MSNightmare) released his ninth unpatched Windows vulnerability called LegacyHive. This latest bug drop is a Local Privilege Escalation (LPE) vulnerability affecting Windows User Profile, a component responsible for loading and unloading Windows user profiles. When exploited, LegacyHive can enable attackers to load other users’ hives and gain access to application data and Windows Explorer history, among others.
Analysis Summary
# Vulnerability: LegacyHive Local Privilege Escalation
## CVE Details
- **CVE ID:** Not yet assigned (Zero-day)
- **CVSS Score:** N/A (Estimated High)
- **CWE:** CWE-269: Improper Privilege Management / CWE-284: Improper Access Control
## Affected Systems
- **Products:** Microsoft Windows Desktop and Server versions.
- **Versions:** All current versions, including those updated with the July 2026 Patch Tuesday updates.
- **Configurations:** Systems utilizing Windows User Profiles for loading/unloading user hives.
## Vulnerability Description
LegacyHive is a Local Privilege Escalation (LPE) flaw originating in the Windows User Profile component. This component manages the loading and unloading of registry hives associated with user profiles. The vulnerability allows a local attacker to bypass access controls to load the registry hives of other users—including administrators—without requiring their credentials. This effectively grants the attacker access to sensitive data stored within those hives.
## Exploitation
- **Status:** PoC available (Note: The researcher released a "stripped" version that requires manual adjustment to function fully).
- **Complexity:** Medium (The stripped PoC requires "brain cells" or technical expertise to modify for full exploitation).
- **Attack Vector:** Local
## Impact
- **Confidentiality:** High (Access to other users' application data, Windows Explorer history, and sensitive registry keys).
- **Integrity:** Medium (Potential to modify registry settings for other users).
- **Availability:** Low
## Remediation
### Patches
- **None:** As of the latest report, Microsoft has not yet released a patch or publicly acknowledged the vulnerability.
### Workarounds
- **Strict Access Control:** Limit local access to sensitive systems to trusted users only.
- **Monitor Profile Activity:** Enhance auditing for unusual user profile loading/unloading events, particularly those originating from non-privileged accounts.
## Detection
- **Indicators of Compromise:** Unusual registry hive loading events (e.g., a standard user account loading the NTUSER.DAT or UsrClass.dat of an administrative or different user account).
- **Detection methods and tools:** Monitor system logs for Event IDs related to User Profile Service hive operations that deviate from standard login/logout patterns.
## References
- hxxps[://]git[.]churchofmalware[.]org/Nightmare_Eclipse/LegacyHive
- hxxps[://]www[.]levelblue[.]com/blogs/spiderlabs-blog/legacyhive-nightmare-eclipses-latest-zero-day-drop-with-a-stripped-poc
- hxxps[://]www[.]bleepingcomputer[.]com/news/microsoft/microsoft-july-2026-patch-tuesday-fixes-massive-570-flaws-3-zero-days/