# CVE-2026-33825: Microsoft Defender Local Privilege Escalation via BlueHammer TOCTOU Race Condition

> A local privilege escalation vulnerability in Microsoft Defender's signature-update mechanism combines a TOCTOU race condition with path confusion to allow low-privileged users to access the SAM database, dump NTLM hashes, and escalate to NT AUTHORITY\SYSTEM. A fully functional public PoC (BlueHammer) was leaked on GitHub on April 3, 2026 by researcher 'Chaotic Eclipse' after MSRC disclosure frustration. Patched in April 2026 Patch Tuesday (Antimalware Platform 4.18.26050.3011).

- **Published:** 2026-04-15T12:00:00Z
- **Last reviewed:** 2026-07-11T00:52:40.772Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0367
- **ID:** TL-2026-0367
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-33825

## Description

CVE-2026-33825 is a local privilege escalation vulnerability in Microsoft Defender Antivirus's signature update mechanism that allows a low-privileged local user to escalate to NT AUTHORITY\SYSTEM. The vulnerability, publicly known as 'BlueHammer,' was discovered by security researcher 'Chaotic Eclipse' (GitHub alias: Nightmare-Eclipse) and leaked as a fully functional proof-of-concept on GitHub on April 3, 2026, after frustration with Microsoft Security Response Center's (MSRC) disclosure handling process.

The exploit chains together five legitimate Windows features in a novel TOCTOU (Time-of-Check to Time-of-Use) race condition combined with path confusion. The attack begins by querying Windows Update COM interfaces for pending Defender signature updates and downloading the legitimate update executable to extract the embedded CAB file containing mpasbase.vdm. The attacker then drops an EICAR test file to bait Defender into scanning activity, places a batch opportunistic lock (oplock) on RstrtMgr.dll as a timing tripwire, and enumerates \\Device for HarddiskVolumeShadowCopy devices.

The critical freezing phase leverages Windows Cloud Files API abuse. The exploit registers a directory as a Cloud Files sync root via CfRegisterSyncRoot() (using the provocative provider name 'IHATEMICROSOFT'), places a .lock placeholder file, and when Defender accesses this file, the batch oplock freezes the Defender process at a precise timing window via GetOverlappedResult blocking. With Defender frozen, the exploit accesses the SAM, SYSTEM, and SECURITY registry hives through VSS shadow copy device paths (\\Device\HarddiskVolumeShadowCopy*\Windows\System32\Config\{SAM,SYSTEM,SECURITY}).

The credential extraction phase recovers the Windows boot key from the SYSTEM hive's Control\Lsa registry keys (JD, Skew1, GBG, Data), then uses this to decrypt the LSA secret key and Password Encryption Key, ultimately decrypting NTLM hashes via AES/DES operations in a Mimikatz-style routine. The final escalation phase changes the local Administrator password (using the hardcoded temporary password '$PWNed666!!!WDFAIL') via SamiChangePasswordUser(), authenticates via LogonUserEx(), duplicates the token with SYSTEM integrity, creates a temporary GUID-named Windows service spawning cmd.exe as NT AUTHORITY\SYSTEM, and then restores the original password hash to cover tracks.

Microsoft patched the vulnerability in the April 8, 2026 Patch Tuesday release with Antimalware Platform version 4.18.26050.3011. Microsoft credited Zen Dodd and Yuanpei XU of HUST with Diffract for the advisory. Will Dormann of Tharros confirmed the PoC no longer works after the patch. However, the exploit code was publicly available for 5 days before the patch, and a reimplementation by 'atroubledsnake' (SNEK_BlueWarHammer) with bug fixes and Visual Studio 2022 build instructions further lowers the barrier to exploitation. Microsoft Defender's static signature (Exploit:Win32/DfndrPEBluHmr.BB) only detects the original PoC binary, and a basic recompile defeats it, making behavioral detection essential.

The exploit requires local access, an active Windows Defender installation, and a pending Defender definition update. It is most reliable on Windows 10 and Windows 11 desktop systems; exploitation on Windows Server editions is unreliable and only elevates to administrator level rather than SYSTEM. The exploit's dependency on Defender update timing introduces unreliability, and the original PoC contained several implementation bugs including uninitialized handle pointers, incorrect buffer sizing in cryptographic operations, and race condition timing issues — all of which were fixed in the SNEK reimplementation.

Related historical vulnerabilities include CVE-2021-36934 (HiveNightmare) which also exposed SAM hive data through permissive ACLs, and multiple Cloud Files driver elevation-of-privilege vulnerabilities (CVE-2025-55680, CVE-2025-62221, CVE-2024-30085, CVE-2024-49114, CVE-2025-21271) indicating a persistent pattern of security issues in the Windows Cloud Files subsystem.

## MITRE ATT&CK

- T1068 Exploitation for Privilege Escalation
- T1003 OS Credential Dumping
- T1543 Create or Modify System Process
- T1569 System Services
- T1685 Disable or Modify Tools
- T1552 Unsecured Credentials
- T1098 Account Manipulation
- T1005 Data from Local System
- T1550 Use Alternate Authentication Material
- T1574 Hijack Execution Flow
- T1548 Abuse Elevation Control Mechanism
- T1082 System Information Discovery
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1211 Exploitation for Stealth
- T1070 Indicator Removal
- T1033 System Owner/User Discovery
- T1069 Permission Groups Discovery
- T1016 System Network Configuration Discovery
- T1087 Account Discovery
- T1489 Service Stop
- T1486 Data Encrypted for Impact
- T1105 Ingress Tool Transfer

## Sources

- [BleepingComputer: Disgruntled researcher leaks BlueHammer Windows zero-day exploit](https://www.bleepingcomputer.com/news/security/disgruntled-researcher-leaks-bluehammer-windows-zero-day-exploit/)
- [Cyderes Howler Cell: BlueHammer Inside the Windows Zero-Day](https://www.cyderes.com/howler-cell/windows-zero-day-bluehammer)
- [RH-ISAC: BlueHammer Windows LPE Zero-Day Publicly Released](https://rhisac.org/threat-intelligence/bluehammer-windows-local-privilege-escalation-zero-day-publicly-released/)
- [Microsoft April 2026 Patch Tuesday (163 Flaws, Two Zero-Days)](https://ap7i.com/posts/microsoft-april-2026-patch-tuesday/)
- [Help Net Security: BlueHammer Windows zero-day exploit leaked](https://www.helpnetsecurity.com/2026/04/08/bluehammer-windows-zero-day-exploit-leaked/)
- [SOCRadar: BlueHammer Windows Zero-Day Privilege Escalation Risk](https://socradar.io/blog/bluehammer-windows-zero-day-privilege-escalation-risk/)
- [CSO Online: April Patch Tuesday roundup — zero-day vulnerabilities and critical bugs](https://www.csoonline.com/article/4158706/april-patch-tuesday-roundup-zero-day-vulnerabilities-and-critical-bugs.html)
- [Penligent: BlueHammer and the Windows Defender Race to SYSTEM](https://www.penligent.ai/hackinglabs/bluehammer-and-the-windows-defender-race-to-system)
- [Exploit Pack: BlueHammer Analysis (Defender LPE)](https://www.exploitpack.com/blogs/news/blue-hammer-analysis-ms-defender-lpe)
- [CyberSecurityNews: BlueHammer PoC for Windows Defender Exploited by Researchers](https://cybersecuritynews.com/bluehammer-poc-for-windows-defender/)
- [Automox: BlueHammer What You Need to Know and How to Respond](https://www.automox.com/blog/bluehammer-what-you-need-to-know-and-how-to-respond)
- [GitHub: BlueHammerFix — 7 Sigma rules, 4 YARA rules, MITRE ATT&CK-mapped report](https://github.com/technoherder/BlueHammerFix)
- [GitHub: Nightmare-Eclipse/BlueHammer — Original PoC repository](https://github.com/Nightmare-Eclipse/BlueHammer)
- [GitHub: atroubledsnake/SNEK_Blue-War-Hammer — Reimplementation with bug fixes](https://github.com/atroubledsnake/SNEK_Blue-War-Hammer)
- [Tenable: Microsoft April 2026 Patch Tuesday Addresses 163 CVEs](https://www.tenable.com/blog/microsofts-april-2026-patch-tuesday-addresses-163-cves-cve-2026-32201)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0367