legacyhive

The legacyhive tag covers reporting and defensive guidance on LegacyHive, a newly public and unpatched local privilege-escalation flaw in Windows User Profile Service (ProfSvc). Coverage focuses on how a standard user with existing code execution may coerce a SYSTEM-level component into loading another user’s registry hive, potentially exposing administrator-profile registry data or enabling a path to SYSTEM. The issue is especially relevant to shared desktops, jump boxes, terminal servers, developer workstations, and other multi-user environments. This tag is useful for tracking detection, containment, proof-of-concept developments, and Microsoft’s eventual response to the LegacyHive vulnerability.