New Windows SignDrop zero-day gives hackers SYSTEM privileges

Security researcher Abdelhamid Naceri (also known as Nightmare Eclipse) has released a new Windows zero-day exploit that can let attackers gain SYSTEM privileges.

Named SignDrop, it exploits mitigations Microsoft introduced in October 2025 to defend against authentication attacks targeting vulnerabilities in the Common Log File System (CLFS) driver.

Naceri added that attacks exploiting CLFS vulnerabilities dropped sharply after the mitigation, but that Microsoft's mitigation itself introduced this new vulnerability.

According to Naceri, the flaw is in how CLFS handles creating the authentication file () when it creates a new log file.

He also added that privileged processes such as Windows Defender can be forced to open the files, so the authentication file gets created with SYSTEM privileges, and CLFS creates it with the original file's access permissions.

​While SignDrop can't be used against all Windows machines, Naceri tested the exploit on Windows 11 26H2, Windows 11 26H2 Experimental, and Windows Server 2025 Experimental and estimates that 80% of Windows installations are vulnerable.

Naceri recommends running the proof-of-concept (PoC) exploit to check if a Windows device is vulnerable to SignDrop attacks or to check the CLFS authentication mode under the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode registry value.

He said that CLFS enforces access checks correctly at the start, but the logic can be abused if a different, privileged process later opens the log file.

Naceri noted that Microsoft implemented the mitigation properly but that the logic allows abuse and said the technique works against any antimalware engine's self-defense (tamper protection), because the file-creation request appears to come from the engine's own legitimate process.

If everything is chained correctly, funnily, this legit security mitigation can be used against itself and allow an elevation of privileges; if the PoC exploit spawns a SYSTEM shell, the machine is vulnerable.

Additionally, if the registry value is 0 or 1 (learning mode or enforcement mode), the computer is vulnerable.

Naceri added that there is currently no solution except waiting for a patch from Microsoft, since disabling the CLFS mitigation would expose the devices to attacks exploiting memory corruption vulnerabilities.

Five years ago, Naceri released several zero-day exploits that allowed privilege escalation on various Windows versions.

While Microsoft has fixed some of the security flaws Naceri disclosed since the start of the year (including ShieldBreak, RoguePlanet, YellowKey, GreenPlasma, and MiniPlasma flaws), the other zero-day bugs still lack an official patch.