Executive Summary
RedSun (CVE-2026-41091) is a critical local privilege escalation (LPE) vulnerability discovered by Nightmare Eclipse that targets the Windows Defender Antimalware Service (MsMpEng.exe). The flaw exists in how Defender handles file remediation for Cloud Files placeholders; when a malicious file is detected with a cloud reparse tag, Defender attempts to rewrite the file to its original location using SYSTEM privileges rather than deleting it. This behavior can be weaponized by standard users to redirect file writes into protected system directories.
The attack chain leverages deterministic timing control through NTFS batch opportunistic locks (oplocks) and filesystem redirection via NTFS junction points. By freezing Defender's remediation process at precise intervals, an attacker can swap a detected malicious file for a Cloud Files placeholder and redirect the write path to C:\Windows\System32. This allows for the placement of an attacker-controlled binary that can be executed as SYSTEM through COM service activation.
This vulnerability represents a significant risk as it bypasses standard privilege boundaries on any Windows system with Defender's real-time protection enabled. It effectively turns the security product itself into a write primitive for privilege escalation. Organizations should prioritize patching CVE-2026-41091 and monitor for unusual filesystem manipulation (junctions/oplocks) involving Defender's working directories.