Nightmare Eclipse released three zero-day exploits named PrettyPrague, FalconFlank, and GreenSection targeting Avast, CrowdStrike, and Nvidia products respectively. PrettyPrague targets Avast's sandbox to escalate privileges and spawn a system shell; this vulnerability also potentially affects other GenDigital products like AVG and Norton and has been patched by GenDigital. FalconFlank exploits a bug in CrowdStrike Falcon Sensor's Office malicious macro remediation feature to escalate privileges; CrowdStrike is investigating and recommends disabling a specific Windows policy setting while maintaining cloud anti-malware protections. GreenSection targets an out-of-bounds memory write in Nvidia user-mode components, which can be used for cross-user boundary attacks or compromise the dwm.exe process, but does not immediately grant system privileges. The exploits follow a previous zero-day disclosed by the researcher affecting Kaspersky, which has been patched. There is no confirmed active exploitation in the wild for these new exploits.

Successful exploitation of these zero-day vulnerabilities allows attackers to escalate privileges to system level on affected endpoints. This can enable attackers to execute arbitrary code with full system privileges, potentially leading to full system compromise. The Avast vulnerability affects sandbox escape and privilege escalation. The CrowdStrike vulnerability affects the Office macro remediation feature, potentially bypassing protections and escalating privileges. The Nvidia vulnerability involves memory corruption that can be leveraged for cross-user attacks or process compromise but does not immediately yield system privileges. These impacts are significant for endpoint security and system integrity.

GenDigital (Avast) has fixed the vulnerability affecting its products and encourages users to update to the latest versions. CrowdStrike advises customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting while relying on Cloud Anti-malware for Microsoft Office Files settings for protection; they are actively investigating the issue. Nvidia has not yet provided a public statement or patch; users should monitor official Nvidia advisories for updates. There is no indication of active exploitation in the wild. Users should apply available patches promptly and follow vendor guidance.