Nightmare Eclipse publishes three new PoCs, including ones for Avast and CrowdStrike
- Researcher 'Nightmare Eclipse' released public proof-of-concept exploits today targeting Avast, CrowdStrike Falcon, and NVIDIA GPU drivers, researchers said on social posts. - PoCs labeled PrettyPrague, FalconFlank, and GreenSection reportedly enable privilege escalation to SYSTEM even on fully patched endpoints; the posts were publicly posted. - No widespread exploitation reported; vendors CrowdStrike and GenDigital are investigating and issuing mitigations this week. (x.com)
1/ Nightmare Eclipse has published three public proof-of-concept exploits tied to Avast, CrowdStrike Falcon and NVIDIA software, according to security reporting and the researcher’s public repositories. SecurityWeek said the releases were disclosed on Sept. 8, while earlier reporting shows FalconFlank was already public by Sept. 3. (securityweek.com) 2/ The key point is not “internet-scale compromise.” The issue is local privilege escalation: code that can take a low-privilege Windows user and try to reach NT AUTHORITY\SYSTEM on machines that are otherwise fully updated. BleepingComputer and the Cloud Security Alliance both described FalconFlank that way. (bleepingcomputer.com) 3/ The three names being tracked are PrettyPrague for Avast, FalconFlank for CrowdStrike Falcon Sensor, and GreenSection for NVIDIA. Multiple outlets and the researcher’s repository listings match those names to those targets. (securityweek.com) 4/ FalconFlank is the clearest of the three from a defender-response standpoint. Reporting says it abuses CrowdStrike Falcon’s Microsoft Office macro-remediation behavior to elevate privileges on updated Windows 11 25H2 and Windows Server 2025 systems with Falcon installed. (bleepingcomputer.com) 5/ CrowdStrike has not, in the material reviewed, published a full advisory dedicated to FalconFlank. But CrowdStrike’s developer documentation confirms there is a prevention-policy setting for Microsoft Office suspicious macro removal, the same feature outside researchers say FalconFlank abuses. (developer.crowdstrike.com) 6/ The practical mitigation now circulating is to disable that Microsoft Office suspicious macro removal policy and rely on other protections instead while CrowdStrike investigates. That recommendation was reported by BleepingComputer, The Register and other security outlets; I did not find an official CrowdStrike blog post spelling it out. (bleepingcomputer.com) 7/ PrettyPrague is the Avast-related PoC. The Register reported the exploit abuses Avast Sandbox to dump the Windows SAM database and spawn a SYSTEM shell, and SecurityWeek reported Gen Digital confirmed a vulnerability exists in some products, including Avast Antivirus, and said the issue has been fixed. (theregister.com) 8/ That Gen Digital point matters because it appears to be the most concrete vendor-status update in this cluster: Avast’s parent said a fix exists, while CrowdStrike was still investigating in the reporting I found. Gen Digital’s public advisory pages were harder to tie directly to this issue, but SecurityWeek attributed the confirmation to the company. (securityweek.com) 9/ GreenSection is murkier. The researcher’s public repo describes a global shared memory section in NVIDIA user-mode components with broad read/write access, and says checks normally prevent obvious impact. Security reporting says the PoC can trigger memory corruption and crashes, but the path to reliable SYSTEM-level escalation is less clearly demonstrated than with FalconFlank or PrettyPrague. (github.com) 10/ That distinction is important because some social posts and secondary writeups grouped all three as SYSTEM-level exploits. The reporting I found is firmer on SYSTEM escalation for FalconFlank and PrettyPrague than for GreenSection, where some outlets describe a possible escalation path rather than a fully demonstrated one. (labs.cloudsecurityalliance.org) 11/ There is also no verified sign, in the sources I reviewed, of widespread in-the-wild exploitation. SecurityWeek explicitly said there was no evidence of active exploitation when it wrote about the three releases. (securityweek.com) 12/ The broader security takeaway is narrower than the hype: these PoCs reinforce that endpoint security tools and adjacent privileged software can themselves become attack surface. That framing was made explicitly by several security analyses, though it remains an interpretation from named researchers and outlets, not a vendor statement. (msn.com) 13/ If you run CrowdStrike Falcon on Windows, the immediate thing to check is whether the Microsoft Office suspicious macro removal policy is enabled in prevention settings. CrowdStrike’s own developer docs show that setting exists; outside reporting ties it to FalconFlank. (developer.crowdstrike.com) 14/ If you run Avast, the immediate question is versioning and update status. SecurityWeek reported Gen Digital said the underlying issue had been fixed, so defenders will want to confirm endpoints are fully updated and watch for any vendor follow-up naming affected products beyond Avast. (securityweek.com) 15/ For NVIDIA, the immediate issue is visibility rather than a confirmed enterprise mitigation. I did not find a formal NVIDIA response in the sources reviewed, and the public repo plus reporting suggest GreenSection is still being evaluated by researchers for practical exploitability and impact. (igorslab.de) 16/ Net: three PoCs are public, two appear to have clearer privilege-escalation claims than the third, one vendor says it has fixed its issue, and CrowdStrike users have a specific configuration to review now. (securityweek.com) 17/ If you want, I can turn this into: - a cleaner 8-post X thread - a SOC-focused internal advisory - or a vendor-by-vendor mitigation checklist.
