Researcher Discloses Windows Zero-Day After Microsoft Legal Threat

The ShieldBreak vulnerability exploits a flaw within Windows Defender, the built-in anti-malware engine. According to the researcher's post, a successful attack allows an attacker to escalate their privileges from a low-level user to gain full control over the device and its data. The proof-of-concept exploit was released as a Windows application that requires user execution. The bug is confirmed to work on Windows 10, Windows 11 (including version 25H2), and Windows Server 2025, with verification provided by security researcher Will Dormann, who noted that Windows Defender must be enabled for the exploit to function.

This latest exploit builds upon a previous vulnerability called RoguePlanet, developed by the same researcher. While Microsoft had previously patched RoguePlanet, Nightmare Eclipse suggests that the fix was insufficient and that ShieldBreak demonstrates a complete bypass of the earlier patch. Microsoft has not yet released a fix for ShieldBreak, classifying it as a zero-day due to the immediate public disclosure without prior notification to the software maker.

The ongoing tension between Nightmare Eclipse and Microsoft stems from the researcher's claims of mistreatment and inadequate handling of their bug reports by the company. This has led to public disclosures of several Windows bugs, some of which have reportedly been exploited in real-world attacks. Microsoft's initial threat of legal action in May was met with significant criticism from the security community, though the company later softened its stance publicly, its original blog post remains published.