Microsoft has patched LegacyHive, a logic-based local privilege escalation (LPE) primitive targeting the Windows User Profile Service (ProfSvc). The vulnerability allows a low-privileged attacker to redirect the loading of a target user's UsrClass.dat registry hive into their own namespace via Object Manager symbolic link redirection and synchronized profile loading. This primitive enables unauthorized cross-user access to sensitive registry data, including application configurations and Windows Explorer history. While initially disclosed as a zero-day by researcher NightmareEclipse and verified by Cyderes' Howler Cell, the flaw is now addressed in a recent massive security update cycle.

• Overview: The LegacyHive Primitive

  • Released by researcher NightmareEclipse as part of a continuous sequence of zero-day disclosures, including BlueHammer and RedSun.
  • Functions as a "building block" primitive rather than a standalone exploit, designed to be chained into more complex escalation or persistence flows.
  • Confirmed to impact Windows 11, specifically targeting the logic governing user profile initialization.

• Technical Deep Dive: Exploitation Vector

  • Targets the ProfSvc (User Profile Service) during the profile loading sequence to bypass security boundaries.
  • Utilizes a combination of offline registry hive modifications and Object Manager symbolic link redirection.
  • Forces the system to load the target's UsrClass.dat hive into the HKU<SID>_Classes namespace of a low-privileged user.
  • Requires the attacker to possess valid credentials for a secondary local user and the username of the target account.

• Impact and Scope

  • Provides unauthorized access to sensitive registry-based user data across different security contexts.
  • Exposes critical application data and Windows Explorer history, facilitating reconnaissance or further credential harvesting.
  • Represents a high-severity risk in multi-user environments where an attacker has already gained initial local access.

• Industry Context: AI-Assisted Discovery

  • Discovered amidst a broader surge in vulnerability discovery attributed to AI-assisted research methods.
  • Contributed to unprecedented patch volumes, with some Microsoft cycles now addressing nearly 400 vulnerabilities simultaneously.
  • Highlights a trend toward logic-based primitives over traditional memory corruption bugs to achieve privilege escalation.

• Remediation and Defense

  • Deploy the latest Microsoft cumulative security updates to patch the ProfSvc logic flaw.
  • Monitor for anomalous Object Manager symbolic link creations and unexpected access patterns involving UsrClass.dat.
  • Enforce strict Principle of Least Privilege (PoLP) to limit the presence and accessibility of secondary local accounts.