Windows Zero-Day "LegacyHive" Exploits User Profile Service for Privilege Escalation
A newly disclosed Windows zero-day vulnerability, dubbed LegacyHive (or MSNightmare), abuses the User Profile Service (ProfSvc) to enable local privilege escalation, allowing attackers to tamper with administrator accounts and execute arbitrary code with elevated permissions.
The flaw, demonstrated via a public proof-of-concept (PoC) on GitHub, exploits how ProfSvc loads and unloads user registry hives during logon/logoff. Specifically, it enables a low-privileged user to mount another user’s UsrClass.dat registry hive typically restricted to the HKEY_CLASSES_ROOT into their own session. Security researcher Will Dormann confirmed that this grants access to an administrator’s application data and configurations, effectively bypassing security boundaries.
While read-only access to UsrClass.dat does not directly expose password hashes, it provides a foothold for malicious modifications. Attackers can alter file associations, COM objects, or shell extensions in the admin’s hive, redirecting legitimate processes to execute arbitrary code. For example, Dormann demonstrated hijacking a .txt file association to launch calc.exe instead of a text editor, illustrating how the exploit can embed persistence mechanisms that activate during an admin’s normal login.
The attack leverages a race condition in ProfSvc’s hive-loading routines, where an initial ACCESS DENIED response is followed by a successful retry under an impersonated NT AUTHORITY\SYSTEM context. This technique mirrors previously documented Windows kernel impersonation flaws, enabling SYSTEM-level effects without direct kernel access.
Despite Microsoft’s July 2026 Patch Tuesday updates addressing hundreds of CVEs, LegacyHive remains unpatched across all supported Windows desktop and server versions. Microsoft has acknowledged the report but has not assigned a CVE or released a dedicated fix. The PoC’s current version requires credentials for a second standard user, but the researcher claims the original exploit could coerce ProfSvc to load any hive without additional credentials, potentially expanding its impact.
As a post-compromise tool, LegacyHive requires prior access to a system and a non-admin account. However, it provides a stealthy path to escalate privileges, with activity appearing as legitimate admin behavior, evading endpoint detection and response (EDR) tools. Organizations are advised to monitor registry hive modifications and COM/object registration changes in privileged accounts until a patch is issued.
Source: https://cybersecuritynews.com/windows-legacyhive-0-day-vulnerability/
Microsoft Security Response Center cybersecurity rating report: https://www.rankiteo.com/company/microsoft-security-response-center
"id": "MIC1784298242",
"linkid": "microsoft-security-response-center",
"type": "Vulnerability",
"date": "7/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Technology',
'location': 'Global',
'type': 'Operating System'}],
'attack_vector': 'Local',
'data_breach': {'file_types_exposed': ['Registry hives (UsrClass.dat)'],
'sensitivity_of_data': 'High (administrator-level access)',
'type_of_data_compromised': 'Application data and '
'configurations (e.g., file '
'associations, COM objects, shell '
'extensions)'},
'description': 'A newly disclosed Windows zero-day vulnerability, dubbed '
'*LegacyHive* (or *MSNightmare*), abuses the User Profile '
'Service (*ProfSvc*) to enable local privilege escalation, '
'allowing attackers to tamper with administrator accounts and '
'execute arbitrary code with elevated permissions. The flaw '
'exploits how *ProfSvc* loads and unloads user registry hives '
'during logon/logoff, enabling a low-privileged user to mount '
'another user’s *UsrClass.dat* registry hive into their own '
'session. This grants access to an administrator’s application '
'data and configurations, bypassing security boundaries. '
'Attackers can alter file associations, COM objects, or shell '
'extensions to execute arbitrary code, embedding persistence '
'mechanisms.',
'impact': {'data_compromised': 'Administrator’s application data and '
'configurations (e.g., file associations, COM '
'objects, shell extensions)',
'operational_impact': 'Arbitrary code execution with elevated '
'permissions, persistence mechanisms',
'systems_affected': 'All supported Windows desktop and server '
'versions'},
'investigation_status': 'Unpatched (Microsoft acknowledged but no CVE '
'assigned)',
'lessons_learned': 'The exploit highlights the risks of race conditions in '
'Windows kernel impersonation and the need for vigilant '
'monitoring of registry modifications in privileged '
'accounts.',
'post_incident_analysis': {'corrective_actions': 'Microsoft to release a '
'patch; organizations to '
'monitor registry '
'modifications',
'root_causes': 'Race condition in ProfSvc’s '
'hive-loading routines, enabling '
'impersonation of NT '
'AUTHORITY\\SYSTEM context'},
'recommendations': ['Monitor registry hive modifications and COM/object '
'registration changes in privileged accounts',
'Apply Microsoft patches once available',
'Restrict low-privileged user access to sensitive '
'registry hives'],
'references': [{'source': 'GitHub PoC'},
{'source': 'Will Dormann (Security Researcher)'}],
'response': {'containment_measures': 'Monitor registry hive modifications and '
'COM/object registration changes in '
'privileged accounts',
'enhanced_monitoring': 'Monitor registry hive modifications and '
'COM/object registration changes in '
'privileged accounts'},
'title': "Windows Zero-Day 'LegacyHive' Exploits User Profile Service for "
'Privilege Escalation',
'type': 'Privilege Escalation',
'vulnerability_exploited': 'LegacyHive (MSNightmare) - User Profile Service '
'(ProfSvc) race condition'}