Zero-Day Bug in Windows Defender Exposes Users to System-Wide Access

A new vulnerability in Windows Defender, dubbed ShieldBreak, has been published by security researcher Nightmare Eclipse, allowing hackers to escalate their permissions and gain full access to a user's device and data.

Nightmare Eclipse's latest disclosure is the latest in a series of bugs affecting Microsoft's products, including Windows. The researcher claimed that Microsoft mistreated them and did not handle their bug reports sufficiently, leading to the public disclosure of the bugs.

According to Nightmare Eclipse's post, ShieldBreak takes advantage of a flaw in Windows Defender, allowing a hacker to escalate their permissions from a low-level user to full access to the device and its data. The bug works on Windows 10, Windows 11 (including the latest 25H2 version), and Windows Server 2025, the researcher said.

Security researcher Will Dormann verified that the bug works and that Windows Defender must be enabled for the exploit to work.

Microsoft has not yet released a patch for the ShieldBreak bug. A spokesperson for Microsoft did not immediately comment when contacted by TechCrunch. The bug is considered a zero-day because the software maker — in this case, Microsoft — was given no time to patch the bug before it was publicly disclosed.

This latest exploit builds on an earlier exploit that Nightmare Eclipse developed dubbed RoguePlanet. Microsoft rolled out a patch for RoguePlanet, but the researcher implied that Microsoft's fix was not sufficient and that their latest exploit demonstrates a full bypass of the earlier patch.

The release of this new zero-day is the latest in a long back-and-forth between the security researcher and the software giant over the company's alleged handling of their bug reports.

In May, Microsoft published a blog post threatening to take legal action against security researchers, like Nightmare Eclipse, if they released details of zero-days outside of the company's disclosure policies. The company faced heavy rebuke from the security community, many of whom described similar experiences with Microsoft's handling of their bug reports. Microsoft later walked back the comments in a social media post. Its original blog post remains published and unchanged.

ShieldBreak lands a day after Microsoft's regularly scheduled monthly security patch releases, dubbed Patch Tuesday.

• The bug is considered a zero-day because Microsoft was given no time to patch it before its public disclosure.
• The exploit works on Windows 10, Windows 11, and Windows Server 2025.
• Microsoft has not yet released a patch for the ShieldBreak bug.
• The bug is a result of a flaw in Windows Defender.

The security community has been heavily critical of Microsoft's handling of bug reports, with many describing similar experiences with the company's disclosure policies.

When it comes to addressing security vulnerabilities, it's essential for software makers to prioritize transparency and collaboration with security researchers. By doing so, they can ensure that their users are protected from potential threats and build trust within the security community.

In this case, Microsoft's handling of the bug reports has led to a series of public disclosures, including the latest ShieldBreak vulnerability. It remains to be seen whether the company will take steps to address the concerns of security researchers and improve its handling of bug reports.

The security researcher's decision to publish the details of the ShieldBreak bug highlights the importance of collaboration and transparency in addressing security vulnerabilities.