What is legacyhive?

LegacyHive is a proof of concept for a security vulnerability in the Windows user profile service, known as ProfSvc, that lets a low privileged process load an attacker chosen registry hive into another user's profile space. Registry hives are the files Windows uses to store a user's settings, and being able to load an arbitrary one where it does not belong can let an attacker escalate their privileges on the machine. To run the version published here, someone needs credentials for a second standard user account plus the name of a third account, which can be an administrator's account. If the exploit works, it ends up mounting the target user's registry hive inside the current user's own classes root, the part of the registry that Windows consults for file type and application associations. The author explains that this published version was intentionally weakened before release, as an attempt to make it harder for others to exploit the bug directly. The original version of the proof of concept did not need that extra set of credentials and was not limited to loading only the usrclass.dat hive, it could load any registry hive, though doing so took more understanding of the vulnerability than what has been shared here. According to the README, the vulnerability was confirmed to still work against every currently supported Windows desktop and server version, even after installing the July 2026 security patches. Beyond the description above, the README is sparse: there is no license listed, no build or usage instructions, and no further technical detail on the underlying flaw.