A newly disclosed vulnerability, dubbed RedSun, exposes a serious flaw in Microsoft Windows Defender that allows standard users to escalate privileges to SYSTEM level without requiring administrative rights, kernel exploits, or UAC bypass. This issue highlights how even trusted security components can introduce risk when validation mechanisms are incomplete.
Security researcher Chaotic Eclipse demonstrated this exploit on fully patched Windows systems, proving that the flaw lies not in outdated software but in Defender’s internal logic. The vulnerability stems from improper validation in the file remediation workflow, specifically within the Malware Protection Engine.
Root Cause of the Vulnerability
At the core of this issue is a missing validation step during Defender’s file restoration process. When a malicious file is detected—particularly one tagged via cloud intelligence—Defender attempts to restore it to its original location.
However, the system fails to verify whether the destination path has been altered using reparse points (junctions). This allows an attacker to manipulate the path mid-operation and redirect the write process into protected directories such as: C:\Windows\System32
Because Defender operates with SYSTEM privileges, it unknowingly writes attacker-controlled binaries into critical system locations.
Technical Breakdown of the Exploit Chain
The RedSun exploit is not based on a single bug but rather a clever chaining of legitimate Windows features:
1. Opportunistic Locks (OPLOCKs)
Used to pause Defender at a precise execution point, creating a reliable race condition.
2. Cloud Files API (CfApi.dll)
Allows creation of placeholder files that interact predictably with Defender’s scanning engine.
3. Volume Shadow Copy Service (VSS)
Used as a signal mechanism—detecting when Defender begins remediation.
4. Junction Points (Reparse Points)
Enable redirection of file operations to sensitive directories like System32.
Exploit Walkthrough
Step 1: Monitoring Shadow Copies
The attacker watches for new VSS snapshots, indicating Defender has initiated remediation.
Step 2: Triggering Detection
A reversed EICAR test string is written and executed, forcing Defender to flag it as malicious.
Step 3: OPLOCK & Directory Swap
Using OPLOCK, the attacker pauses Defender, deletes the file, and replaces the directory with a junction pointing to System32.
Step 4: Unauthorized Write
Defender resumes operation and writes the file into System32 without detecting the redirection.
Step 5: SYSTEM Execution
The malicious binary is executed via a COM server, granting SYSTEM-level access.
Why This Happens
The vulnerability exists because Defender’s remediation pipeline trusts the original file path without revalidation. No function in the execution chain checks whether the path has been modified using reparse points.
A simple validation call such as:
FSCTL_GET_REPARSE_POINTGetFinalPathNameByHandle
could have prevented this entire attack.
Impact
- Affects Windows 10, Windows 11, and Windows Server (2019+)
- Works on fully patched systems (as of April 2026)
- Requires only local, non-admin access
- Achieves near 100% reliability
Currently, no official patch or CVE has been assigned.
Mitigation Strategies
Until a fix is released, organizations should rely on behavioral detection:
- Monitor abnormal VSS enumeration from user processes
- Detect unauthorized Cloud Files API usage
- Alert on junction creation in temporary directories
- Flag unusual writes to System32 by Defender processes
- Restrict cloud-delivered protection only in isolated scenarios
Our Opinion on the RedSun Vulnerability
The RedSun exploit is a powerful reminder that modern cybersecurity threats increasingly emerge not from obvious coding errors but from subtle logic flaws in trusted systems. Windows Defender is designed to protect users, yet this vulnerability demonstrates how its elevated privileges can be turned against the system itself.
What makes this case particularly concerning is the absence of basic validation in a critical security workflow. The lack of reparse point checks is not a complex oversight—it is a fundamental security control that should exist in any privileged file operation. This raises important questions about internal security auditing and threat modeling within widely deployed defensive tools.
Additionally, the exploit’s reliability and lack of dependency on advanced techniques (like kernel exploits) lower the barrier for attackers significantly. This could make RedSun attractive for real-world attacks, especially in environments where users have local access but limited privileges.
From a defensive standpoint, this incident reinforces the importance of behavior-based monitoring over signature-based detection. Since the exploit uses legitimate Windows features, traditional antivirus methods are unlikely to detect it effectively.
Ultimately, RedSun underscores a critical lesson: security tools must be designed with the assumption that their own trust boundaries can be abused. Until Microsoft releases a patch, proactive monitoring and strict endpoint controls remain the best line of defense.
