BlueHammer Windows Defender Zero-Day Enables Local Privilege Escalation
Summary
BlueHammer is a publicly disclosed Windows Defender zero-day with a public proof of concept that can let a local low-privilege user escalate access. The article says no official patch is available.
Key points
- The vulnerability affects Windows hosts and servers through Microsoft Defender’s signature-update workflow.
- Exploitation requires local access and the ability to run code as a low-privileged user.
- The reported exploit combines a TOCTOU race, path confusion, and symbolic-link manipulation to redirect privileged file operations.
- The article reports escalation to SYSTEM on hosts and, at this time, Administrator on servers.
- A public proof-of-concept is available; exploitation requires precise timing and is not fully reliable.
- No official patch is available. Suggested precautions include limiting local access and monitoring Defender update activity.
Article Details
- Vulnerability Types
- Time-of-Check to Time-of-Use (TOCTOU) race condition
- Path confusion
- Symbolic link manipulation
- Severity
- Described as particularly critical; no formal severity rating provided.
- Exploitation Status
- unknown
- Exploit Availability
- public_poc
- Patch Status
- unavailable
- Workarounds
- Enforce least privilege principles.
- Restrict local and interactive access.
- Monitor Defender-related activity and update processes.
Vendors
Products
Microsoft Defender AntivirusMicrosoft Defender Antivirus, particularly its signature update mechanismMicrosoft WindowsBlueHammer is a publicly disclosed zero-day local privilege escalation (LPE) vulnerability affecting Microsoft Windows systems via Microsoft Defender. A working proof-of-concept (PoC) exploit has been released publicly,