NewsBite analysis · Security
Ars Technica
Locked in heated rivalry with researcher, Microsoft fixes 0-day they disclosed
Microsoft has issued a patch for a high-risk zero-day vulnerability, CVE-2026-45586, revealed by researcher Nightmare Eclipse. The patch comes after tensions escalated due to disagreements over disclosure agreements. The flaw, linked to the Windows Collaborative Translation Framework, could allow privilege escalation and potentially facilitate malware installation. This incident underscores ongoing challenges in vulnerability management.
MonitorConfidence: HighImmediate horizonCybersecurity risk: High
Published 9 Jun 2026, 21:55 UTC2 min read
Visit original article ↗Lead image — Ars Technica
Summary
TL;DR
- Microsoft fixed CVE-2026-45586, a high-severity zero-day vulnerability
- The vulnerability was disclosed by researcher Nightmare Eclipse amidst disputes
- The flaw could allow local privilege escalation to install malware
- A second vulnerability, dubbed MiniPlasma, was also addressed
- Tensions reflect broader issues in vulnerability disclosure practices
Interesting facts
- The researcher disclosed vulnerabilities after feeling wronged by Microsoft
- The zero-day required minimal complexity to exploit
- No evidence suggests the vulnerability was actively exploited