LegacyHive Windows Zero-Day Lets Attackers Hijack Administrator Registry Hives

## Executive summary A proof-of-concept named LegacyHive exploits inconsistent access-control when Windows loads an administrator's Classes hive (usrClass.dat), allowing a non-admin user to gain write access via a SYSTEM fallback and plant registry changes (file associations or COM registrations) that execute with administrator privileges when the admin next logs in. The issue is a local privilege escalation zero-day with demonstrated PoC, no patch at publication, and significant detection challenges in shared or multi-user environments.