Locked in heated rivalry with researcher, Microsoft fixes 0-day they disclosed

On Tuesday, Microsoft unveiled a patch for a significant zero-day vulnerability that had been exposed by a researcher embroiled in a contentious relationship with the tech giant. Alongside this, another zero-day vulnerability also appears to have been rectified. Known by the alias Nightmare Eclipse, the researcher has recently disclosed several serious vulnerabilities, raising concerns about potential exploitation in real-world scenarios. This series of disclosures, which included proof-of-concept code, followed what Nightmare Eclipse described as Microsoft's failure to adhere to a prior agreement concerning the vulnerabilities that were under discussion. In a statement from March, the researcher expressed dissatisfaction, stating, "But someone violated our agreement and left me homeless with nothing. They knew this would happen, and they still stabbed me in the back anyway; this is their decision, not mine." As part of its June patch release, Microsoft addressed CVE-2026-45586, a vulnerability that Nightmare Eclipse had disclosed in May under the name GreenPlasma. This particular vulnerability allows for local privilege escalation, enabling low-level privileges on a device to bypass operating system protections and gain full SYSTEM rights, which are necessary for installing malware. Microsoft characterized CVE-2026-45586 as having low complexity for exploitation and requiring no user interaction, indicating a significant risk of active exploitation in the wild. The issue stemmed from "improper link resolution before file access ('link following') in the Windows Collaborative Translation Framework." Thankfully, there have been no confirmed instances of this vulnerability being actively exploited thus far. Additionally, vulnerability analyst Will Dormann from Tharros Labs noted that Tuesday’s patch also addressed a separate vulnerability disclosed by Nightmare Eclipse, referred to as MiniPlasma. Interestingly, he pointed out that Microsoft did not mention this specific fix. This vulnerability was allegedly resolved six years ago under the identifier CVE-2020-17103, but it seems either the fix was inadequate or the issue resurfaced as a regression.