CVE-2026-33825: Microsoft Defender Local Privilege Escalation via BlueHammer TOCTOU Race Condition — Threadlinqs Intelligence
As of 2026-07-11, CVE-2026-33825: Microsoft Defender Local Privilege Escalation via BlueHammer TOCTOU Race Condition is a high-severity vulnerability threat attributed to a N/A-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 26 indicators of compromise.
Threat ID: TL-2026-0367 · Severity: HIGH · CVSS: 7.8 · Status: ACTIVE · Category: VULNERABILITY
Updated: 2026-07-11 · revalidated 1× · latest source
Attribution: N/A · FINANCIAL
A local privilege escalation vulnerability in Microsoft Defender's signature-update mechanism combines a TOCTOU race condition with path confusion to allow low-privileged users to access the SAM
CVE-2026-33825 is a local privilege escalation vulnerability in Microsoft Defender Antivirus's signature update mechanism that allows a low-privileged local user to escalate to NT AUTHORITY\SYSTEM. The vulnerability, publicly known as 'BlueHammer,' was discovered by security researcher 'Chaotic Eclipse' (GitHub alias: Nightmare-Eclipse) and leaked as a fully functional proof-of-concept on GitHub on April 3, 2026, after frustration with Microsoft Security Response Center's (MSRC) disclosure handling process.
The exploit chains together five legitimate Windows features in a novel TOCTOU (Time-of-Check to Time-of-Use) race condition combined with path confusion. The attack begins by querying Windows Update COM interfaces for pending Defender signature updates and downloading the legitimate update executable to extract the embedded CAB file containing mpasbase.vdm. The attacker then drops an EICAR test file to bait Defender into scanning activity, places a batch opportunistic lock (oplock) on RstrtMgr.dll as a timing tripwire, and enumerates \\Device for HarddiskVolumeShadowCopy devices.
The critical freezing phase leverages Windows Cloud Files API abuse. The exploit registers a directory as a Cloud Files sync root via CfRegisterSyncRoot() (using the provocative provider name 'IHATEMICROSOFT'), places a .lock placeholder file, and when Defender accesses this file, the batch oplock freezes the Defender process at a precise timing window via GetOverlappedResult blocking. With Defender frozen, the exploit accesses the SAM, SYSTEM, and SECURITY registry hives through VSS shadow copy device paths (\\Device\HarddiskVolumeShadowCopy*\Windows\System32\Config\{SAM,SYSTEM,SECURITY}).
The credential extraction phase recovers the Windows boot key from the SYSTEM hive's Control\Lsa registry keys (JD, Skew1, GBG, Data), then uses this to decrypt the LSA secret key and Password Encryption Key, ultimately decrypting NTLM hashes via AES/DES operations in a Mimikatz-style routine. The final escalation phase changes the local Administrator password (using the hardcoded temporary password '$PWNed666!!!WDFAIL') via SamiChangePasswordUser(), authenticates via LogonUserEx(), duplicates the token with SYSTEM integrity, creates a temporary GUID-named Windows service spawning cmd.exe as NT AUTHORITY\SYSTEM, and then restores the original password hash to cover tracks.
Microsoft patched the vulnerability in the April 8, 2026 Patch Tuesday release with Antimalware Platform version 4.18.26050.3011. Microsoft credited Zen Dodd and Yuanpei XU of HUST with Diffract for the advisory. Will Dormann of Tharros confirmed the PoC no longer works after the patch. However, the exploit code was publicly available for 5 days before the patch, and a reimplementation by 'atroubledsnake' (SNEK_BlueWarHammer) with bug fixes and Visual Studio 2022 build instructions further lowers the barrier to exploitation. Microsoft Defender's static signature (Exploit:Win32/DfndrPEBluHmr.BB) only detects the original PoC binary, and a basic recompile defeats it, making behavioral detection essential.
The exploit requires local access, an active Windows Defender installation, and a pending Defender definition update. It is most reliable on Windows 10 and Windows 11 desktop systems; exploitation on Windows Server editions is unreliable and only elevates to administrator level rather than SYSTEM. The exploit's dependency on Defender update timing introduces unreliability, and the original PoC contained several implementation bugs including uninitialized handle pointers, incorrect buffer sizing in cryptographic operations, and race condition timing issues — all of which were fixed in the SNEK reimplementation.
Related historical vulnerabilities include CVE-2021-36934 (HiveNightmare) which also exposed SAM hive data through permissive ACLs, and multiple Cloud Files driver elevation-of-privilege vulnerabilities (CVE-2025-55680, CVE-2025-62221, CVE-2024-30085, CVE-2024-49114, CVE-2025-21271
Weaknesses (CWE)
CWE-367, CWE-22, CWE-1220
Target sectors: government, financial, healthcare, technology, education, critical-infrastructure, defense, energy
Target regions: Global
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 26 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2026-33825, T1068, T1003, T1543, T1569, T1562, T1552, T1098, T1005, T1550, T1574