A Zero-Day Researcher Known as Nightmare Eclipse Turns From Microsoft to CrowdStrike, Nvidia, and Avast

An anonymous security researcher who spent the past five months publishing a string of unpatched Microsoft zero-days has spent the last two weeks doing the same thing to the security industry itself. Since late August, the researcher known as Nightmare Eclipse (also going by Chaotic Eclipse, Infinite Nightmare, and MSNightmare) has released proof-of-concept exploit code for previously unknown flaws in Kaspersky’s endpoint antivirus, GenDigital’s Avast Antivirus, CrowdStrike’s Falcon Sensor, and Nvidia’s GPU display driver components, all without a coordinated disclosure window and all before any of the affected companies had a fix ready.

None of the four vulnerabilities has been assigned a CVE identifier as of this writing, which means they currently sit outside the standard tools most security teams use to track and prioritize patching. Independent security researcher Kevin Beaumont has confirmed that the exploits targeting Kaspersky, Avast, and CrowdStrike all work as described; he separately verified that the Nvidia bug crashes the system rather than granting elevated privileges.

Three unpatched exploits in a single week

The researcher’s own technical write-ups, cited by SecurityWeek, BleepingComputer, and The Register, describe three distinct bugs released within days of each other.

PrettyPrague: Avast Antivirus

PrettyPrague abuses a flaw in the Avast Sandbox component to dump the Windows SAM database (the local file that stores hashed account credentials) and spawn a full SYSTEM-level command shell. GenDigital owns Avast, AVG, and Norton, and SecurityWeek reported the researcher’s claim that the same bug may also affect the other two GenDigital-branded products, not just Avast.

FalconFlank: CrowdStrike Falcon Sensor

FalconFlank is a privilege escalation bug that abuses CrowdStrike Falcon’s built-in Office malicious macro remediation feature, the component that automatically strips suspicious macro code out of Office documents. According to the researcher’s own notes, the proof of concept works on a fully updated Windows 11 25H2 or Windows Server 2025 machine running Falcon with the “Phase 3: Optimal Protection” policy and macro remediation both enabled, letting an attacker spawn a SYSTEM-level command prompt.

GreenSection: Nvidia GPU drivers

GreenSection targets an out-of-bounds memory write in a shared memory section used by several of Nvidia’s user-mode GPU display driver components on Windows. The researcher speculated the bug might eventually be developed into something that crosses between user accounts or compromises the Windows desktop compositor process, but said they had not built that further exploit themselves. Beaumont’s independent testing found the demonstrated impact is a denial-of-service crash, not privilege escalation.

How the vendors have responded, and how fast

The four companies are at four different points in their response. Kaspersky has already shipped a fix for the earlier HardBreacher bug in its endpoint antivirus, delivered automatically or by triggering a manual database update, and confirmed the issue is resolved.

GenDigital’s timeline shows how quickly things can move once a researcher goes public without warning. On September 3, the company told The Register it was “actively developing a patch” for the Avast flaw. By September 7, its statement to SecurityWeek had changed: “We immediately initiated our security response procedures and have fixed the issue. We take all security matters seriously and encourage users to keep their products up to date to ensure they are protected.”

CrowdStrike has not reached that point yet. Its statement to both SecurityWeek and BleepingComputer has stayed consistent for days: “We are actively investigating these claims and advise customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting. Customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings. We refer customers to the FalconFlank Tech Alert in the CrowdStrike support portal.” That tech alert is not public; only customers with an active support portal login can read it.

Nvidia’s public response arrived last. The Register reported on September 3 that the company had not answered its inquiries. By September 7, an Nvidia spokesperson told SecurityWeek: “NVIDIA is reviewing the reported behavior through our established security and product engineering processes. NVIDIA takes reports of this nature seriously and is actively investigating to determine the root cause, affected configurations, and appropriate remediation.” No fix or advisory has been published.

The pattern started with Microsoft

This is not Nightmare Eclipse’s first disclosure spree. Since April, the same researcher has published proof-of-concept zero-days against a string of Microsoft products and components, using the code names LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend. One of those, a Windows Defender privilege escalation bug called BlueHammer, was later flagged by CISA as a vulnerability seen in ransomware campaigns, a sign that a researcher’s early proof-of-concept code does not stay theoretical for long once it is public. Patch status across the full list of eight varies by flaw, and Microsoft has not published one consolidated advisory covering all of them.

The Register has described the researcher, who has never revealed their identity, as pursuing what it called a “singular Microsoft vendetta” before branching out to other vendors this month. BleepingComputer reported that after the earlier disclosures, Microsoft issued warnings about legal action against “malicious activity causing real harm to our customers,” language that, in BleepingComputer’s words, led many to believe the company was directly threatening the researcher. Neither Microsoft nor Nightmare Eclipse has publicly confirmed that account in detail.

Beaumont, who has independently verified several of the exploits, told The Register he was not surprised the researcher moved beyond Microsoft: “Kinda makes sense they’d branch out to other vendors as there’s problems across the endpoint security space with the quality of the security products in terms of security unfortunately. Hopefully it causes cybersecurity vendors to up their game, stop hyping hypothetical AI attacks, and instead make their own products secure for customers.”

What security teams should do now

Because none of these four bugs has a CVE number yet, they will not show up in a routine vulnerability scan or patch-management dashboard search. Security teams that use any of the affected products should track this by vendor advisory instead of by CVE for now:

• CrowdStrike Falcon customers should apply the workaround CrowdStrike has published: disable the Microsoft Office File Suspicious Macro Removal Windows policy setting, and confirm Cloud Anti-malware for Microsoft Office Files protection is active. Check the CrowdStrike support portal directly for the FalconFlank Tech Alert, since it is not indexed publicly.
• Avast, AVG, and Norton users should confirm they are on the latest build, since GenDigital says a fix has already shipped through its normal update mechanism.
• Nvidia GPU driver users on Windows should watch for a driver update addressing the shared memory section issue; no patch exists yet, and Nvidia has not published a specific configuration workaround.
• Kaspersky Endpoint customers should confirm an automatic update has applied, or trigger a manual database update, to pick up the HardBreacher fix.

All four of the underlying bugs require some form of local access or an existing foothold on the machine to exploit, since they are privilege escalation or denial-of-service issues rather than remote code execution from the open internet. That lowers the urgency slightly compared to an internet-facing flaw, but it also means these bugs are exactly the kind that ransomware operators and other attackers look for once they already have a way onto a system, the same pattern sxz.io covered when CISA flagged an earlier Nightmare Eclipse-linked Defender flaw as actively used in ransomware campaigns after its own disclosure and patch cycle.