Microsoft has released a fix for two high-severity zero-day vulnerabilities that were disclosed by a researcher known as Nightmare Eclipse. The researcher claims the software giant reneged on an agreement, leading to this latest round of disclosure drama.

Nightmare Eclipse, whose real identity is unknown, disclosed a local privilege escalation vulnerability in May under the name GreenPlasma. This flaw could be chained with another vulnerability to grant full SYSTEM rights, potentially allowing the installation of malware. In June's patch batch, Microsoft addressed CVE-2026-45586, acknowledging it as a 'link following' issue within the Windows Collaborative Translation Framework.

The researcher has been vocal about their grievances, stating that someone violated an agreement and left them in a difficult position. Despite this tension, Microsoft's swift action suggests a willingness to collaborate despite past disputes.

In response to the disclosure, Microsoft issued a fix for CVE-2026-45586, warning of its minimal complexity and the likelihood of active exploitation if not patched. For now, there are no indications that this vulnerability has been actively exploited in the wild.