Prolific Microsoft 0-day hunter drops CrowdStrike Falcon exploit PoC
Researcher Nightmare Eclipse released a PoC for FalconFlank, a privilege escalation zero-day in CrowdStrike Falcon's Office macro remediation feature.
Researcher Nightmare Eclipse published a zero-day PoC dubbed FalconFlank targeting CrowdStrike Falcon's Microsoft Office malicious macro removal feature, achieving privilege escalation on fully updated Windows 11 25H2 and Windows Server 2025 with Optimal Protection and macro removal enabled. Kevin Beaumont independently confirmed the exploit works. The same researcher also released HardBreacher, an elevation-of-privilege bug in Kaspersky Endpoint (since fixed via update), PrettyPrague, an Avast Sandbox flaw that dumps the SAM database for a SYSTEM shell (Gen Digital is developing a patch), and GreenSection, an Nvidia memory corruption bug that crashes systems. CrowdStrike advises customers to disable the Suspicious Macro Removal Windows policy while it investigates.
- FalconFlank abuses Falcon's Office malicious macro removal feature for privilege escalation; PoC works on fully patched Windows 11 25H2.
- Companion PoCs: HardBreacher (Kaspersky EoP, now fixed), PrettyPrague (Avast SAM dump), GreenSection (Nvidia crash).
- CrowdStrike recommends disabling the Suspicious Macro Removal policy; cloud anti-malware settings keep customers protected.
- Kevin Beaumont confirmed FalconFlank, HardBreacher, and the Avast PoC work on updated systems.
From the original article
3 min read at theregister.comThe disgruntled security researcher known as Nightmare Eclipse (aka Chaotic Eclipse, Infinite Nightmare, and now also MSNightmare) is moving away from their singular Microsoft vendetta and on to other vendors. On Thursday, they dropped a new zero-day bug called FalconFlank that affects CrowdStrike’s Falcon endpoint security platform - albeit with a Windows link.
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.