LegacyHive Windows Zero-Day Exploit Allows Registry Data Access

Originally published on CyberNetSec.

Executive Summary

A new zero-day vulnerability in Microsoft Windows, dubbed LegacyHive, was disclosed on July 15, 2026, just one day after Microsoft's record-setting July Patch Tuesday. The vulnerability was published by security researcher NightmareEclipse, who also released a proof-of-concept (PoC) exploit. The flaw exists in all fully patched desktop and server versions of Windows. It allows a local, non-privileged user to read data from another user's registry hive by abusing a flaw in how the Windows Object Manager handles path resolution. While the public PoC is limited to information disclosure, it highlights a fundamental weakness that could potentially be leveraged for more severe attacks.

---

Vulnerability Details

The LegacyHive vulnerability is a local information disclosure flaw. It does not, in its current public form, lead to remote code execution or privilege escalation. The core of the issue is a path resolution bug in the Windows Object Manager that allows a low-privileged user to mount another user's UsrClass.dat registry hive.

The UsrClass.dat file is a user-specific part of the registry that stores per-user application settings, COM object registrations, and user activity artifacts, such as Windows Explorer history. By mounting and reading this file, an attacker who has already gained a low-privileged foothold on a multi-user system (like a terminal server) could spy on the activity and application usage of other users, including administrators.

Affected Systems

• Products: All fully patched versions of Microsoft Windows desktop and server operating systems as of the July 2026 security updates.

Exploitation Status

A proof-of-concept exploit has been publicly released on GitHub. There is currently no evidence of this vulnerability being actively exploited in the wild. However, the public availability of the PoC means that threat actors can now analyze and potentially weaponize it. The researcher, NightmareEclipse, noted that the technique could potentially be modified to target other, more sensitive registry hives, though this has not been demonstrated publicly. This disclosure follows a pattern from the same researcher, who previously disclosed the 'RoguePlanet' flaw in June.

Impact Assessment

The immediate impact of the public PoC is limited to information disclosure. An attacker could use it to gather intelligence on a compromised system, learning about the applications used by other logged-in users. This information could be valuable for tailoring further stages of an attack. For example, an attacker could identify if an administrator uses a specific remote management tool and then craft a phishing lure related to that tool.

If the technique can be adapted to mount more sensitive hives, such as the SAM or SECURITY hives (which would likely require higher privileges to begin with), the impact could escalate significantly. However, as it stands, LegacyHive is primarily a local reconnaissance tool.

---

Cyber Observables — Hunting Hints

The following patterns may help identify the use of the LegacyHive PoC or similar techniques:

Type	Value	Description	Context
command_line_pattern	reg load	The PoC likely uses the reg load command or its underlying API call (RegLoadKey) to mount the target user's hive. Monitor for this command being used with unusual paths.	EDR, Sysmon Event ID 1, PowerShell Logging
file_path	C:\Users\<user>\AppData\Local\Microsoft\Windows\UsrClass.dat	Monitor for access to this file by a process running under a different user's context.	File Auditing, EDR
registry_key	HKU\<SID>_Classes	After loading the hive, the attacker would access it under a temporary key in the HKEY_USERS hive. Monitor for unusual keys being loaded and then quickly unloaded.	Registry Auditing, EDR

Detection Methods

1. Command-Line Auditing: Enable process command-line logging and create detection rules for suspicious usage of reg.exe. Specifically, look for reg load commands where the user executing the command is different from the user whose hive is being loaded.
2. File Access Monitoring: Implement file access auditing on the UsrClass.dat file in user profiles. Alert when a process owned by UserA attempts to read the UsrClass.dat file belonging to UserB. This aligns with D3FEND Decoy File principles, treating these files as sensitive objects.
3. Behavioral Analysis: Use an EDR solution to detect the overall chain of behavior: a low-privileged process accessing another user's profile directory, followed by registry loading operations, and then registry query operations against the newly mounted hive.

Remediation Steps

As this is a zero-day vulnerability, there is no patch available from Microsoft at this time. The following are potential compensating controls:

1. Limit Local Access: The vulnerability requires an attacker to have local access to the system. Limiting interactive logons to only authorized users, especially on multi-user servers, reduces the opportunity for exploitation.
2. Application Allowlisting: Use application allowlisting solutions like AppLocker to prevent non-privileged users from executing unauthorized code, including the PoC exploit.
3. Endpoint Detection and Response (EDR): A properly configured EDR solution may be able to detect and block the suspicious behavior associated with the exploit, even without a specific signature, based on its heuristic and behavioral analysis engines.