New zero-day targets Microsoft Windows: LegacyHive vulnerability disclosed
Critical flaw allows attackers to access Windows user registry hives
1New attack from zero-day hunter
Microsoft's nemesis Nightmare Eclipse has published a new zero-day vulnerability targeting Windows user registry hives. Dubbed LegacyHive, this flaw exploits a weakness in the profsvc service to enable privilege escalation. The vulnerability allows attackers to access other users' system settings and configurations.
2Limited impact scope
Security experts note that while the flaw could be useful for attackers already present in a system, it doesn't provide full system compromise. The published PoC is deliberately limited and requires additional credentials. However, skilled attackers could potentially complete the missing components to weaponize it.
3Strategic timing trap for Microsoft
The disclosure came right after Microsoft's monthly Patch Tuesday updates, maximizing the exposure window before a fix can be developed. This tactic aims to put Microsoft in a difficult position. Previous similar vulnerabilities were quickly adopted by malware operators, according to security researchers.
4Did legal threats make a difference?
Nightmare Eclipse's decision not to release a fully functional PoC this time might reflect Microsoft's legal action threats. However, the hunter claims the original PoC works without requiring additional credentials. Microsoft hasn't yet issued an official statement regarding this vulnerability.
5Urgent action call for security teams
Cybersecurity professionals warn that capable attackers could complete the partial PoC. Huntress team reminds that previous similar flaws were rapidly weaponized by ransomware groups and recommends immediate defensive measures. The timeline for an official patch remains uncertain.
6Microsoft's ongoing security challenge
LegacyHive works against systems fully patched with July updates, highlighting Microsoft's ongoing vulnerability management struggles. As a prime target for zero-day hunters, the company faces both technical and legal battles in maintaining system security.