LegacyHive Zero-Day Exploit for Windows Privilege Escalation

Originally published on CyberNetSec.

Executive Summary

A security researcher known as "Nightmare Eclipse" has publicly released a proof-of-concept (PoC) exploit for a new zero-day vulnerability in Microsoft Windows, dubbed "LegacyHive." The exploit enables a local attacker to achieve privilege escalation on fully updated Windows systems, including those with the July 2026 Patch Tuesday updates. The vulnerability exists within the Windows User Profile Service and allows a low-privilege user to access sensitive data from other user accounts on the same machine. Microsoft has not yet assigned a CVE identifier or released a patch for this flaw.

Vulnerability Details

The LegacyHive exploit targets a logical flaw in how the Windows User Profile Service handles user registry hives. Specifically, it allows a malicious actor to mount a target user's UsrClass.dat hive file with read access. The UsrClass.dat file is a registry hive located in each user's profile (%USERPROFILE%\AppData\Local\Microsoft\Windows\UsrClass.dat) that stores per-user application settings and other data.

By mounting this hive, an attacker can read a wide range of application-specific information, Windows Explorer history, and other forensic artifacts. While the current PoC focuses on data access, the researcher suggests the technique could be modified to target more sensitive hives, potentially leading to the exposure of password hashes or other credentials. This disclosure is the latest in a series from the same researcher, who has previously released other Windows zero-days.

Affected Systems

• All modern versions of Microsoft Windows are presumed to be affected, as the exploit was demonstrated on a fully patched system.

Exploitation Status

A functional proof-of-concept exploit has been made public. While this does not confirm in-the-wild attacks, the public availability of the exploit code significantly increases the likelihood of its adoption by threat actors. The attack requires an initial foothold on a system as a low-privilege user.

Impact Assessment

The immediate impact of the LegacyHive exploit is local privilege escalation (LPE) and information disclosure. An attacker with standard user access could use this exploit to read sensitive data belonging to other users, including administrators, on the same system. This data could facilitate further lateral movement, credential theft, or be exfiltrated for intelligence gathering. In a multi-user environment, such as a terminal server or shared workstation, the risk is significantly higher.

Cyber Observables — Hunting Hints

The following patterns may help identify attempts to exploit LegacyHive:
| Type | Value | Description |
|---|---|---|
| command_line_pattern | reg load | Monitor for the reg load command being used by non-administrative users or to mount hive files from other user profiles. |
| file_path | \AppData\Local\Microsoft\Windows\UsrClass.dat | Look for unusual processes accessing UsrClass.dat files outside of the currently logged-on user's profile directory. |
| event_id | 4656 | In the Windows Security Log, Event ID 4656 (A handle to an object was requested) with Object Type Key can be audited to track access to registry hives. |
| process_name | userinit.exe | Suspicious processes being spawned by userinit.exe or other user session processes could indicate post-exploitation activity. |

Detection Methods

• D3FEND: Process Analysis (D3-PA): Use an EDR solution to create detection rules that alert on any process attempting to load a registry hive (reg load) from a user profile directory that does not belong to the process's owner.
• D3FEND: Local File Permissions (D3-LFP): While not a direct detection, monitoring for unexpected changes to file permissions on user profile directories could be a precursor or follow-on activity.
• Log Analysis: Forward Windows Security Event Logs to a SIEM. Correlate process creation events (ID 4688) with registry access events (ID 4656, 4663) to identify suspicious patterns of hive loading and access across user boundaries.

Remediation Steps

As of this report, there is no patch available from Microsoft for the LegacyHive vulnerability.

Organizations should focus on compensating controls and detection until a patch is released:

1. Restrict Local Access: Limit interactive logon rights for standard users on critical servers and multi-user systems. Enforce the principle of least privilege.
2. Endpoint Detection: Deploy and tune EDR solutions with rules specifically designed to detect the behavior of the LegacyHive PoC, such as cross-user hive loading.
3. Monitor for Updates: Closely monitor security bulletins from Microsoft for an official patch or mitigation guidance.
4. Application Control: Use application control solutions like AppLocker or ThreatLocker to prevent unauthorized executables from running, which can block the initial payload that would leverage this exploit.