GreenPlasma — CTFMON Section Hijack LPE: Standard User → SYSTEM on Windows 11
TL;DR GreenPlasma (SB2026051378) is an unpatched Windows privilege escalation that chains a ctfmon.exe section creation bug with registry symlink hijacking and DACL relaxation to go from standard user → SYSTEM with zero interaction. No CVE assigned yet. No patch available. Affected: Windows 11, Windows Server 2022/2026 Not affected: Windows 10 (different ctfmon implementation) Requires: Standard user, interactive session Impact: Full SYSTEM shell Researcher: Chaotic Eclipse / Nightmare-Eclipse Public PoC: github.com/Nightmare-Eclipse/GreenPlasma The Context: Chaotic Eclipse’s Disclosure Campaign This is the fifth zero-day from the researcher Chaotic Eclipse (aka Nightmare-Eclipse), who has been publicly releasing Windows vulnerabilities after disputes with Microsoft’s MSRC over bug bounty responses. ...