LegacyHive Zero-Day Exposes Windows User Profile Service Hive-Loading Flaw

Security researcher NightmareEclipse/Chaotic Eclipse publicly released a proof-of-concept exploit for a Windows local elevation-of-privilege zero-day dubbed LegacyHive, targeting the Windows User Profile Service (ProfSvc). The flaw abuses arbitrary registry hive loading to let a standard user mount another user’s registry hive—particularly usrclass.dat—under their own registry classes root, potentially exposing sensitive registry data and enabling privileged read-write access that could support further escalation. Reports said the public PoC was intentionally limited and may require additional user credentials, while the researcher claimed the original technique could load arbitrary hives without that restriction.

The disclosure said the issue affects fully patched supported Windows desktop and server versions, including systems updated through July 2026, and no CVE, Microsoft advisory, or official patch had been identified at the time of publication. Researchers and defenders warned that, although the released PoC does not by itself guarantee full system compromise, it provides a strong post-compromise primitive that skilled attackers could weaponize quickly, especially given prior rapid criminal adoption of the researcher’s earlier Microsoft disclosures. Background documentation on Windows registry hives shows that user profile hives store application settings, desktop configuration, environment data, network connections, and other per-user information, underscoring the sensitivity of unauthorized hive access.