LegacyHive Windows Zero-Day Lets Attackers Hijack Administrator Registry Hives

A newly disclosed Windows local privilege-escalation vulnerability, dubbed LegacyHive, could allow a standard user to load and modify the per-user registry classes hive of an administrator account.

The proof-of-concept (PoC), published by researcher NightmareEclipse under the MSNightmare/LegacyHive GitHub repository, abuses Windows’ User Profile Service to mount a target user’s UsrClass.dat hive into a registry location accessible from a lower-privileged account.

LegacyHive Windows Zero-Day

The issue affects currently supported Windows desktop and Windows Server installations, including systems updated with Microsoft’s July 202620262026 security patches, according to the project’s README.

At the time of disclosure, the repository did not identify any assigned CVE, Microsoft advisory, or vendor-issued fix. The PoC is written in C++ and released under an MIT license. However, its author said the publicly available code was intentionally limited to reduce immediate abuse.

LegacyHive requires local execution and access to credentials for a second standard Windows user, as well as the username of a target account, which may be an administrator.

When successful, the tool causes the target account’s classes registry hive to be mounted under the current user’s classes root. The original research reportedly enabled arbitrary hive loading without requiring additional credentials; however, the public PoC has been restricted to loading UsrClass.dat, the hive used for user-specific file associations, COM registrations, shell settings, and related configuration.

Independent testing by vulnerability researcher Will Dormann confirmed the central behavior. Dormann observed new registry keys appearing under HKEY_USERS while LegacyHive was running and later determined that a non-administrative user could access the administrator’s mounted Classes hive.

This access creates a significant security primitive because modifying the registry configuration of a privileged account can alter how applications, files, and COM components behave when that account logs on or interacts with the desktop.

In a basic demonstration, Dormann used the flaw to alter the administrator user’s .txt file association, so that text files opened in Calculator instead of the expected application.

While harmless in isolation, the example illustrates that an attacker can tamper with settings normally protected by the target account’s permissions.

More dangerous abuse could involve modifying a COM object registration invoked during an administrator’s login, potentially enabling code execution in that user’s security context. Such activity could enable attackers to move from an initial foothold as a regular local user to control of an administrative session.

Process Monitor observations suggest the flaw stems from privilege handling in the User Profile Service (ProfSvc). The service initially attempts to open the targeted administrator’s UsrClass.dat while impersonating the supplied standard user and receives an access-denied error.

It then retries the operation under NT AUTHORITY\SYSTEM, successfully opens the protected file, and exposes the loaded hive in a manner that remains accessible to the non-admin caller.

Organizations should treat LegacyHive as a potentially high-impact local escalation risk, particularly on shared endpoints, jump hosts, and servers where administrators use interactive logons.

Until Microsoft provides guidance or a patch, defenders should restrict local access; prevent standard users from obtaining credentials for other local accounts; monitor unusual ProfSvc activity and unexpected hive mounts under HKEY_USERS; and investigate modifications to user-level COM registrations and file associations for privileged accounts.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.