NightmareEclipse’s LegacyHive PoC lets users mount other users' hives in Windows

NightmareEclipse is back with “LegacyHive,” a Windows local privilege escalation zero-day proof of concept published on Tuesday. The core idea is brutal in its simplicity: it lets a standard user mount other users’ registry hives, including an administrator’s, into their own process. That would translate into privileged read-write access to target users’ hive data, if exploited correctly.

The vulnerability targets Windows’ user hives, the part of the Windows Registry that stores a user's specific desktop settings, application preferences, and environment configurations. The PoC exploits a weakness in profsvc, the Windows User Profile Service, and specifically the way it loads hives. Pentest-Tools.com’s lead researcher Matei Badanoiu zeroed in on the gap between what the public code proves and what a full system compromise would require. In other words: LegacyHive is a local privilege escalation primitive. It is not, by itself, the end of the story attackers would need for full takeover.

That distinction matters for decision-makers because it changes how you think about blast radius. A “full compromise” usually implies chaining behaviors: privilege escalation plus credential access plus persistence. Badanoiu said bundling those elements into “full compromise” is more ambition than what the released code demonstrates. For attackers who already have a foothold inside a target environment, though, a privilege-escalation primitive is absolutely valuable. It can turn an early access moment into something far more dangerous without needing to start the fight from scratch.

The “usefulness” of LegacyHive is also shaped by how stripped down the public PoC is. The Register reports that LegacyHive differs from some earlier drops from NightmareEclipse because this PoC is deliberately “stripped back” to reduce widespread exploitation. According to NightmareEclipse’s description of the published code, the public PoC requires additional user credentials and is limited to the usrclass.dat hive. NightmareEclipse also claims the original PoC, which differs from the one they published, does not require additional user credentials and works beyond the usrclass.dat hive. But NightmareEclipse reportedly said using that version would require “some brain cells to make the PoC do it.”

If that sounds messy, security experts say that messiness is not comforting. Badanoiu noted that there are multiple ways to exploit the profsvc flaw, and some earlier NightmareEclipse drops such as BlueHammer and RedSun went from PoC to widespread exploitation within days. LegacyHive, in contrast, comes without a fully working PoC and without a CVE identifier, which should slow opportunistic attackers but does not stop determined ones. In fact, the absence of a CVE and missing pieces can become a scavenger hunt for threat actors who have the time and talent to reverse engineer the gap.

Dray Agha, senior manager of security operations at Huntress, framed the urgency the way many security leaders now talk about ransomware and threat intelligence response: move quickly because history suggests fast follow-through. Huntress observed NightmareEclipse’s prior LPE and defense evasion tools being rapidly deployed by threat actors and ransomware groups shortly after publication. Agha said capable actors would likely reverse-engineer missing components of the LegacyHive PoC to build fully weaponized versions in short order. For an enterprise security operation, that translates into a familiar operational question: can you detect the behavior that comes with hive mounting and privilege escalation, or will you only know after damage is done?

There is also a broader timing and policy angle, because the disclosure cadence looks designed to maximize exposure. The Register reports that NightmareEclipse dropped the details shortly after Microsoft’s monthly Patch Tuesday updates, which contained an unprecedented 622 fixes. Agha said this kind of timing maximizes the exposure window before a patch can be developed, increasing trouble for Microsoft. There is an additional wrinkle: The Register asked Microsoft whether it plans to release a fix before August’s patches, but Microsoft did not immediately respond. NightmareEclipse claims the latest zero-day works against Windows machines fully patched according to July’s fixes. Separately, Microsoft issued a quiet remedy for an earlier NightmareEclipse zero-day, RoguePlanet, last week, without detailing what the mitigation entailed.

For executives and boards, the second-order implication is simple but uncomfortable: these disclosures are not only technical events, they are operational stress tests. If your security program assumes “Patch Tuesday fixes everything” or if your detection coverage only covers known, fully weaponized exploits, you may be vulnerable to the exact gap Badanoiu described, where the public PoC is incomplete but a post-compromise capability is still actionable. Meanwhile, the lack of an immediate Microsoft response on LegacyHive and the expectation of rapid weaponization by capable attackers turns this into a time-sensitive risk discussion, not a “wait for the CVE” problem.