LegacyHive: Video demo and analysis of Windows 0-day from NightmareEclipse

NightmareEclipse published LegacyHive, a proof-of-concept exploit that leverages Object Manager symbolic links and manipulated profile hive paths to mount another user's UsrClass.dat hive on fully patched Windows systems; while the PoC is incomplete and not immediately weaponized to reveal passwords or execute privileged code, it demonstrates a path-resolution vulnerability affecting desktop and server installations, provides IOCs and detection guidance, and recommends auditing and monitoring of profile hive access and related API/event activity.