New LegacyHive exploit discovered for privilege escalation in Windows

A security researcher using the alias Nightmare Eclipse has published an exploit for a new Windows zero-day vulnerability dubbed LegacyHive.

According to available information, the exploit allows attackers to escalate their privileges on a system, gaining administrator rights. The vulnerability affects current versions of Windows installed with all the latest updates.

What we know

The source provides no details about the technical nature of the vulnerability or whether it was disclosed to Microsoft prior to publication. The name LegacyHive itself points to a connection with legacy components of the Windows system registry, though the exact exploitation mechanism has not been disclosed.

Publishing an exploit under a researcher's own name without first notifying the vendor is a practice that typically raises concern among security professionals, as it shortens the window available for releasing a fix while at the same time handing attackers a ready-made tool for their assaults.

Potential consequences

Escalating privileges to administrator level opens up a wide range of possibilities for attackers: from installing malware and altering system settings to taking full control of a compromised device. Such vulnerabilities are especially dangerous when combined with other vectors of initial access, such as phishing or the exploitation of flaws in third-party applications.

It remains unclear whether Microsoft is preparing a prompt patch to address LegacyHive. Until an official fix is released, users and administrators are advised to keep a close watch on the company's announcements and to apply available mitigation measures as they are published.

Source: Bleeping Computer