Windows Defender Zero-Day “RoguePlanet” Lets Attackers Gain SYSTEM Privileges

A newly disclosed zero-day, dubbed “RoguePlanet,” affects Microsoft Defender on Windows 10 and Windows 11 and allows privilege escalation to NT AUTHORITY\SYSTEM by exploiting a race condition in Defender’s file handling (PoC published). The PoC leverages ISO mounting and timing of file operations; although exploitation reliability varies, the researcher reports near-100% success on some systems, and public availability of the exploit raises significant risk until a patch is issued.