PoC claims Defender bypass on September-patched Windows

ShieldCrash claims arbitrary file reads

Zero-day researcher Nightmare Eclipse, also known as MSNightmare, published a proof of concept called ShieldCrash. The researcher claims it bypasses the earlier ShieldBreak fix and enables arbitrary file reads as SYSTEM, while not providing arbitrary writes or a full SYSTEM shell.

ShieldBreak, an earlier Defender privilege-escalation zero-day, was reported to have been patched last week after RoguePlanet had been patched in July.

A newly published proof of concept, ShieldCrash, claims to bypass the ShieldBreak patch and work on Windows systems with September updates installed.

If accurate, the claim would mean that applying the September updates does not eliminate the reported exposure, extending a sequence of alleged bypasses involving Defender fixes.