Executive Summary
A zero-day local privilege escalation (LPE) vulnerability, dubbed BlueHammer, has been publicly disclosed targeting Windows 11 25H2. The exploit weaponizes the Windows Defender signature update mechanism by leveraging a TOCTOU race condition and path confusion. No CVE or patch currently exists, and functional proof-of-concept code is circulating on GitHub.
The attack is architecturally significant because it utilizes legitimate Windows primitives—such as the Cloud Files API, Volume Shadow Copies, and NTFS junctions—rather than malicious code or unsigned drivers. By manipulating how Defender reads signature updates, an attacker can trick the SYSTEM-level process into reading and leaking the SAM hive from a shadow copy.
While categorized as an LPE, this threat is highly critical in the context of the modern threat landscape. Infostealers like Lumma and Raccoon provide the initial foothold necessary to execute BlueHammer, enabling rapid escalation from commodity access to full domain compromise. Organizations should prioritize detection strategies until an official Microsoft patch is available.