Microsoft Defender 'RoguePlanet' Zero-Day Exploit Exposed, Grants Full SYSTEM Privileges

Microsoft Defender 'RoguePlanet' Zero-Day Exploit Exposed

A security researcher operating under the handle 'Nightmare Eclipse' has publicly released a new zero-day exploit targeting Microsoft Defender, naming it 'RoguePlanet.'

Scope of Impact

According to reports, the exploit is capable of running on fully updated Windows 10 and Windows 11 systems. It takes advantage of a race condition vulnerability within Microsoft Defender to spawn a command prompt with full SYSTEM-level privileges, effectively granting complete control over the affected machine.

Sensitive Timing Raises Concerns

The timing of the disclosure is particularly notable. The exploit was released just hours after Microsoft patched two previously disclosed security vulnerabilities as part of its monthly security update cycle. That Patch Tuesday release has been described as the largest in Microsoft's history—yet it still failed to address this newly surfaced zero-day.

Security Implications

SYSTEM is the highest privilege level in the Windows operating system. An attacker who obtains SYSTEM access can execute arbitrary code, install malware, and access or modify all system files and user data without restriction.

Because Microsoft Defender is Windows' built-in antivirus solution, virtually all Windows users are potentially at risk. As of this writing, Microsoft has not issued an official patch for this zero-day vulnerability. Users are advised to monitor Microsoft's security advisories closely for further updates.

Sources: Slashdot / BleepingComputer

原文來源： 查看原文