Zero-Days in CrowdStrike, Avast, Nvidia Disclosed

Executive Summary

A security researcher operating under the alias Nightmare Eclipse has publicly disclosed three separate zero-day local privilege escalation (LPE) vulnerabilities affecting widely deployed software from CrowdStrike, Avast, and Nvidia. The researcher released proof-of-concept (PoC) exploit code for all three flaws, named 'FalconFlank', 'PrettyPrague', and 'GreenSection'. Each vulnerability allows an attacker who has already achieved initial code execution on a target system to elevate their privileges to NT AUTHORITY\SYSTEM, granting them complete control. While Avast's parent company, GenDigital, claims to have patched its product, CrowdStrike has confirmed it is investigating and has provided interim mitigation guidance. These disclosures highlight the significant risk posed by vulnerabilities within security products themselves, which can be turned into powerful tools for attackers post-compromise.

Vulnerability Details

Three distinct LPE vulnerabilities were disclosed, each targeting a different product and leveraging a unique abuse mechanism.

• FalconFlank (CrowdStrike Falcon Sensor): This vulnerability resides in the CrowdStrike Falcon Sensor for Windows. The exploit abuses the sensor's remediation feature designed to handle malicious Microsoft Office macros. An attacker with low-privilege code execution can manipulate this process to force the Falcon Sensor, which runs with SYSTEM privileges, to load a malicious DLL. This results in the attacker's code being executed with the highest level of privilege on the system. The flaw is confirmed to affect fully patched Windows 11 26H2 and Windows Server 2026 systems.

• PrettyPrague (Avast Antivirus): This exploit targets the sandbox component of Avast Antivirus. The PoC demonstrates the ability to escape the sandbox and spawn a shell with full SYSTEM privileges. The vulnerability may also affect other products from parent company GenDigital, such as AVG and Norton.

• GreenSection (Nvidia Components): This is an out-of-bounds memory write vulnerability affecting a shared global memory section used by multiple Nvidia user-mode components. An attacker can leverage this to write arbitrary data and escalate privileges.

Affected Systems

• CrowdStrike: Falcon Sensor for Windows running on Windows 11 (26H2) and Windows Server 2026. The specific sensor versions affected have not been publicly detailed by CrowdStrike.
• Avast: Avast Antivirus. Parent company GenDigital suggests potential impact on related products like AVG Antivirus and Norton security software.
• Nvidia: Multiple user-mode components. Specific affected drivers or software versions have not been detailed.

Exploitation Status

As of September 7, 2026, proof-of-concept (PoC) exploit code for all three vulnerabilities has been made public by the researcher. There are no public reports of these exploits being used in the wild by other threat actors. However, the public availability of working PoCs significantly increases the likelihood of their adoption and weaponization, especially 'FalconFlank', which targets a prominent EDR solution.

Impact Assessment

While these are local privilege escalation vulnerabilities and require an attacker to have already gained initial access, their impact is severe. Compromising a security product like an antivirus or EDR sensor is a high-value objective for attackers. By escalating to SYSTEM via the very tool meant to detect them, attackers can effectively neutralize the endpoint's defenses, blind the security team, and proceed with lateral movement, credential theft, and data exfiltration undetected. For organizations relying on CrowdStrike Falcon, an attacker could use 'FalconFlank' to bypass endpoint protection and achieve persistence, turning a minor intrusion into a full-blown compromise.

Cyber Observables — Hunting Hints

The following patterns may help identify systems where these exploits have been attempted or successfully executed:

Detection Methods

Detecting the exploitation of these LPEs requires deep system-level monitoring, as the malicious activity will be initiated by a trusted, highly privileged process.

1. Behavioral Analysis: Configure EDR and SIEM systems to alert on unusual behavior from trusted security processes. For example, csfalconservice.exe or AvastSvc.exe spawning cmd.exe, loading unsigned DLLs from non-standard paths, or making outbound network connections are all highly suspicious activities.
2. DLL Load Monitoring: Use tools like Sysmon (Event ID 7) to monitor for suspicious DLLs being loaded by the Falcon Sensor service. An attacker using 'FalconFlank' would need to place a malicious DLL in a location where the service would load it.
3. Command-Line Auditing: Enable process creation logging with command-line arguments (Event ID 4688). An attacker who has successfully escalated privileges will likely use cmd.exe or powershell.exe to execute further commands. The parent process for these shells would be the compromised security service.

Defensive techniques from the D3FEND framework, such as D3-PA (Process Analysis) and D3-SFA (System File Analysis), are crucial for identifying the anomalous process and file activities associated with this type of exploit.

Remediation Steps

Immediate remediation focuses on mitigation and patching where available.

1. CrowdStrike 'FalconFlank' Mitigation: CrowdStrike has advised customers to disable the "Microsoft Office File Suspicious Macro Removal" policy setting within the Falcon console as an interim measure. This disables the vulnerable feature path. Customers should refer to the technical alert in the CrowdStrike support portal for the latest guidance.
2. Avast 'PrettyPrague' Patch: GenDigital has stated the vulnerability has been fixed. Users of Avast, AVG, and Norton products should ensure their software is updated to the latest version. Auto-updates should handle this, but manual verification is recommended.
3. Nvidia 'GreenSection' Patch: No specific patch has been announced. Users should monitor Nvidia's security bulletins and apply driver and software updates as they become available.
4. Principle of Least Privilege: As these are LPE vulnerabilities, ensure that user accounts operate with the lowest possible privileges. This will not prevent the exploit if an attacker gains code execution as that user, but it limits their initial capabilities.
5. Restrict Initial Access: The most effective long-term defense is to harden systems against initial access vectors like phishing, exploitation of public-facing applications, and credential abuse. An attacker cannot use an LPE if they cannot get on the box in the first place.