One Researcher Just Published Working Hacks Against CrowdStrike, Avast, and Nvidia
A prolific security researcher dropped three zero-day exploits in a single week, targeting software that millions of people and businesses rely on to stay safe.
Key points
- A researcher known as Nightmare Eclipse published three zero-day exploits targeting Avast, CrowdStrike, and Nvidia products in one week; a zero-day is a flaw the software maker had not previously discovered or fixed.
- A fourth exploit, against a Kaspersky security product, was published in late August and patched on 31 August 2024.
- Two of the new exploits allow privilege escalation, where an attacker who already has a foothold quietly upgrades their access to full system control.
- GenDigital, which owns Avast, says the Avast flaw is now fixed; CrowdStrike has issued a temporary workaround but no patch yet.
- Independent researcher Kevin Beaumont confirmed the Avast, CrowdStrike, and Kaspersky exploits work as advertised.
A security researcher who goes by Nightmare Eclipse, also tracked under the aliases Chaotic Eclipse and MSNightmare, published three working exploit tools last week against products from Avast, CrowdStrike, and Nvidia.
The release follows a pattern we've tracked since June. Nightmare Eclipse built a reputation targeting Microsoft software, then in late August turned attention to Kaspersky, publishing an exploit dubbed HardBreacher that let a low-privileged attacker silently gain full control of a Windows machine. We covered that release on 31 August; Kaspersky patched the flaw the same day.
What do these three new exploits actually do?
Two of the tools share the same goal: turning limited access into total control of a machine.
PrettyPrague targets the Avast antivirus sandbox, a protected space where suspicious files run in isolation. It breaks out of that space and opens a command shell with full system privileges. GenDigital, the parent company that also owns AVG and Norton, told SecurityWeek the flaw may affect several of its products. A spokesperson said: "We immediately initiated our security response procedures and have fixed the issue. We encourage users to keep their products up to date."
FalconFlank exploits a bug in CrowdStrike Falcon Sensor's Office macro remediation feature, which detects and removes malicious macros hidden inside Office documents. We published the researcher's original FalconFlank disclosure on 3 September. CrowdStrike told SecurityWeek it's investigating and has advised customers to disable the affected policy setting as a temporary precaution. No patch is available yet.
GreenSection targets Nvidia graphics drivers. It writes data outside the memory space a program is allowed to touch, a class of flaw known as an out-of-bounds memory write. Nightmare Eclipse noted the bug "does not get SYSTEM privileges immediately" but "can be used cross user to user boundary easily," adding that a full exploit is left as an exercise for others. That's not a throwaway caveat: cross-account access on a shared machine or a corporate workstation is a meaningful capability even without an immediate path to full system control. Nvidia hadn't responded to a request for comment at publication time.
Should people using these products be worried?
For most home users, the immediate risk is real but not urgent. These exploits require an attacker to already have code running on your machine. The realistic danger is to corporate networks, where attackers get a foothold through phishing and then use tools like these to escalate from a standard account to full control.
| Exploit name | Target product | Effect | Status |
|---|---|---|---|
| HardBreacher | Kaspersky Endpoint Security | Full system privilege escalation | Patched 31 August 2024 |
| PrettyPrague | Avast (also AVG, Norton) | Full system privilege escalation | Patched by GenDigital |
| FalconFlank | CrowdStrike Falcon Sensor | Privilege escalation via Office macro feature | Workaround issued, no patch yet |
| GreenSection | Nvidia graphics drivers | Cross-user memory access | No response from Nvidia |
If you run Avast or AVG, open the application and check for updates now. CrowdStrike customers should check the FalconFlank Tech Alert in the support portal for guidance on disabling the affected Office macro policy setting.
What matters most here isn't the individual bugs; it's the tempo. Four working exploits against four major security vendors in roughly two weeks, all from one researcher, is a stress test that the industry's patch-and-respond cycle clearly wasn't ready for. Watch whether Nvidia responds before someone builds the full exploit Nightmare Eclipse is already hinting at.
