New Microsoft Defender “RedSun” zero-day PoC grants SYSTEM privileges

A researcher published a public proof-of-concept for "RedSun," a Microsoft Defender local privilege escalation zero-day that abuses the Cloud Files API, an EICAR payload, an oplock race, and a directory junction to overwrite and execute TieringEngineService.exe, granting SYSTEM on fully patched Windows 10/11 and Server; the exploit has been independently confirmed and was released alongside criticism of Microsoft's handling of vulnerability disclosures.