A researcher publishing under the names Nightmare Eclipse, Chaotic Eclipse, Infinite Nightmare and MSNightmare released three exploits within a short window, targeting Avast, CrowdStrike and NVIDIA. SecurityWeek reported the set on 7 September 2026.

First, an update to what we wrote

On 3 September this site covered FalconFlank as a single-source claim with no patch and no CVE, and said it should be treated as unverified until somebody other than the researcher confirmed it.

Somebody has. Kevin Beaumont has confirmed that the Avast, CrowdStrike and Kaspersky exploits work, and CrowdStrike has published customer guidance, which is itself an acknowledgement that there is something to guide customers about.

That is a real change in the evidence and it belongs at the top rather than in a correction note. The caution was right at the time; it is no longer the right posture.

Two things still have not changed: there is still no CVE for any of these, and CrowdStrike still has no patch.

The three

PrettyPrague — privilege escalation to full system privileges from inside the Avast sandbox. Gen Digital says it may affect a subset of its products, which would take in AVG and Norton. Proof-of-concept code is on GitHub.

FalconFlank — privilege escalation through a bug in CrowdStrike Falcon Sensor's feature for remediating malicious Office macros.

GreenSection — an out-of-bounds memory write in NVIDIA's user-mode GPU display driver components, in a shared global memory section on Windows, with the potential for cross-user compromise.

What the three have in common

Look at the list and the pattern is not subtle.

An antivirus sandbox. An endpoint agent's cleanup routine. A graphics driver's shared memory.

All three are software that runs above the user in order to serve or protect them, which is exactly why a flaw in any of them escalates. Security software in particular buys its usefulness with privilege: it has to see everything and touch everything, and the cost of that bargain is that its bugs are never ordinary bugs.

The Falcon case is the sharpest version. The affected feature exists to remove malicious macros. The cleanup mechanism is the attack surface.

The mitigation is losing a protection

CrowdStrike's guidance:

We advise customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting... Customers remain protected through Cloud Anti-malware for Microsoft Office Files settings.

Read both halves. The first is turn the feature off. The second is you still have a different control covering the same ground.

That is a reasonable interim position and it is not free — it is a defence-in-depth layer being removed while the vendor works, and the second sentence exists because CrowdStrike knows customers will ask what they lose. Whether the remaining control is equivalent is a question only the customer can answer for their own estate.

Gen Digital's position is simpler:

Gen was recently made aware of a security vulnerability affecting a subset of Gen products... We immediately initiated our security response procedures and have fixed the issue.

NVIDIA's:

NVIDIA is reviewing the reported behavior... NVIDIA takes reports of this nature seriously and is actively investigating.

One fix, one workaround, one investigation, from one week's work by one person.

On the disclosure

These were published without coordinated disclosure. It is worth putting both sides down rather than only the one that flatters the reader's instinct.

Against: three vendors learned about flaws in privileged software at the same time as everyone else, and defenders have no CVE to key a scanner on, which means asset management tooling cannot tell you whether you are affected.

For: Gen Digital fixed it inside a week under exactly these conditions, and the public proof of concept is why CrowdStrike customers have guidance today rather than after a quiet backlog. Coordinated disclosure is better when it works; it does not always work, and the argument that it always does is made mostly by people who have never had a report ignored.

What is not defensible is pretending the trade does not exist.

The fourth product

Kaspersky appears in Beaumont's confirmation and is not among the three named exploits.

Nobody has explained that. It may be a fourth release, an older piece of work, or a reporting artefact. Treat it as an open question rather than a fourth zero-day.

What to do

  • If you run Falcon, decide about the macro removal policy deliberately. Disabling it is CrowdStrike's advice; understand what Cloud Anti-malware does and does not replace before you do it.
  • Update Avast, AVG and Norton. Gen Digital says it is fixed; make sure your fleet actually has it.
  • On NVIDIA, there is nothing to do yet. GreenSection is unfixed and under investigation. Cross-user compromise potential matters most on shared and multi-user Windows hosts, which is where to look first when a fix lands.
  • Do not wait for CVEs to inventory this. There are none, so your scanner will stay quiet regardless of exposure.
  • Assume proof-of-concept code will be reused. PrettyPrague is on GitHub.

What is not established

  • Whether any of these have been exploited in real attacks. No evidence of that has been published.
  • CVE assignments. None have been issued.
  • The full product range affected by PrettyPrague. Gen Digital says "a subset".
  • Whether Kaspersky is a fourth target, and what the exploit against it was.
  • The researcher's motive. Not stated anywhere.
  • When CrowdStrike or NVIDIA will ship a fix.