LegacyHive Windows flaw can hijack admin accounts
A newly found Windows bug lets regular users take over admin accounts by altering their saved settings. Attackers could then install malware or delete files as if they were the admin.
- Severity
- Not scoredNo CVSS score recorded
- Fix
- Not confirmed
- Affects
- Windows
- Exploited
- Not confirmedNo confirmation recorded
How it works
A regular user sends a crafted request to Windows that tricks it into letting them edit admin account settings stored in the registry, which normally only admins can change.
What to do
Check whether the installed Windows version is older than the fixed version in the vendor advisory or current release.
Avoid clicking unknown links or running untrusted software until a patch arrives.
Technical details
LegacyHive exploits a privilege-handling flaw in the Windows User Profile Service (ProfSvc). Impersonating a standard user, the service tries to open a target administrator's UsrClass.dat hive, is denied, then retries as NT AUTHORITY\SYSTEM and succeeds, leaving the loaded hive reachable from the lower-privileged caller's registry space. The public proof-of-concept, released on GitHub as MSNightmare/LegacyHive by researcher NightmareEclipse, is restricted to the UsrClass.dat hive, which governs file associations, COM registrations, and shell settings for that account; the original research reportedly allowed loading arbitrary hives without extra credentials. No CVE, Microsoft advisory, or patch existed at disclosure.