LegacyHive zero-day falls short of promise

NightmareEclipse released LegacyHive, a zero-day local privilege escalation vulnerability targeting Windows User Profile Service. The proof of concept code exploits profsvc to mount another user's registry hive. Security experts say it is a useful post-compromise tool but does not provide full system compromise. Microsoft did not immediately respond about a fix.