A security researcher published Proof-of-Concept (PoC) exploits for three zero-days in a week, two of them in endpoint security products, weeks after HardBreacher, a similar PoC exploit targeting a Kaspersky endpoint product that Kaspersky patched on Aug. 31.
The researcher works under several names, most often Chaotic Eclipse or Nightmare Eclipse. The three exploits are PrettyPrague, which targets Avast, FalconFlank, which targets CrowdStrike Falcon, and GreenSection, which targets Nvidia components.
PrettyPrague targets an Avast sandbox and can dump the Windows Security Account Manager database and spawn a SYSTEM shell, according to the researcher. Avast’s parent company Gen Digital confirmed to Expert Insights that the released fix covers not just Avast but AVG and Norton too, addressing the researcher’s suggestion that other Gen products could be affected.
GreenSection targets an out-of-bounds write in a global memory section shared by several Nvidia user-mode components. The Register reported that security researcher Kevin Beaumont assessed this one as only crashing the system rather than granting privileges. Nvidia has not commented publicly at the time of writing.
CrowdStrike Has a Workaround, Not a Fix
FalconFlank abuses a CrowdStrike Falcon Sensor feature that strips suspicious macros from Microsoft Office files. The researcher said it works on fully updated Windows 11 25H2 and Windows Server 2025 running Falcon in Phase 3 Optimal Protection with macro removal enabled.
CrowdStrike told Expert Insights: “We are actively investigating these claims and advise customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting. Customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings. We refer customers to the FalconFlank Tech Alert in the CrowdStrike support portal.”
No CVE has been published for the flaw at the time of writing, and CrowdStrike’s technical alert is in its support portal, which requires a customer login.
A Pattern in the Researcher’s Targets
FalconFlank is not the first of the researcher’s exploits to target the part of an endpoint product that acts after a detection rather than the part that detects.
RedSun hijacked the privileged file-restore operation Defender performs when it quarantines rather than deletes a flagged file, and BlueHammer exploited a race condition in Defender’s threat remediation engine.
The other two do not follow that shape. GreenSection is a memory handling bug in graphics components, and the Avast issue sits in the sandbox where suspicious files are analyzed rather than in cleanup code.
In those three cases the exploit reached SYSTEM through a function that runs with privileges the user does not have, because removing, restoring or quarantining a file requires them.
Gen Digital told Expert Insights that remediation code receives the same level of security review as detection code. The company said the fix for PrettyPrague underwent additional scrutiny and was validated against a real exploit sample.
The Tooling Works, Using It Is Harder
Beaumont said he had verified the exploits are real and work, naming the Avast and CrowdStrike releases and August’s Kaspersky one.
Whether attackers can use them is a separate question. None of last week’s releases has been confirmed as exploited in the wild.
In April, though, Huntress found all three of the researcher’s Defender exploits on a single compromised host within days of their release, alongside hands-on-keyboard reconnaissance and a compromised FortiGate SSL VPN account.
None of the three succeeded. Huntress assessed that the operator did not appear familiar with the tooling, misreading the documentation and passing flags that did nothing.
Expert Insights contacted CrowdStrike, Gen Digital, and Nvidia for comment. Nvidia had not responded at the time of writing.
