Windows zero-day SignDrop lets ordinary users gain System rights

What the SignDrop exploit does

A researcher using the name Nightmare Eclipse has published a new Windows zero-day, according to Ars Technica. The flaw, named SignDrop, lets a user with ordinary account rights gain System rights, the highest level of access on Windows, on some versions of the operating system.

The weakness sits in the Common Log File System, or CLFS, a logging service that Microsoft describes as serving software running in both user mode and kernel mode. An attacker can push a specially crafted CLFS container through a privileged process, such as Windows Defender, and abuse the resulting file creation to elevate their privileges.

How the attack turns Defender against itself

The exploit chains together CLFS, Windows Defender and Windows file permissions. It calls a legitimate Defender function used for processing antivirus signature updates, so that Defender itself opens a log file created by the standard user.

By manipulating Windows Object Manager symbolic links, the attacker makes Defender open the container while running with the antimalware engine's own privileges. If a related authentication file is missing, CLFS creates it using Defender's System rights, and the new file inherits the access rules of the original file. That can leave the attacker with access to a file created with System privileges.

Nightmare Eclipse wrote that the logic Microsoft implemented is sound on its own, but the way the pieces interact allows abuse. The researcher also claimed the same technique could work against other antivirus or endpoint detection products, because file creation requests would appear to come from the security product's own trusted process. That claim has not been independently confirmed.

A mitigation from 2025 became part of the problem

Ars Technica notes an irony at the heart of the flaw. The vulnerable behaviour stems from a security measure Microsoft introduced in October 2025 to defend CLFS against other attacks.

Microsoft has not responded to a request for comment, so the company's position on the disclosure is unknown. Nightmare Eclipse has published several other Windows zero-days in recent months and has an ongoing public dispute with Microsoft.

Which systems are vulnerable

The researcher published a proof of concept that should open a System-level shell on affected machines.

Researcher Will Dormann told Ars Technica that he reproduced the exploit and that it works as described, but not on every Windows 11 machine. He said it appears to require Windows 26H2 on a system that has existed for more than 90 days, so a freshly installed and updated 26H2 machine will not necessarily be affected.

A system is vulnerable only if the CLFS authentication mode registry value is set to 0 or 1, meaning learning mode or enforcement mode. Dormann said only one of his many machines met that condition. Because Microsoft rolls out updates such as 26H2 gradually, it is unclear how many devices currently have it. Users can check their version by running the winver command.

Why it matters and what to watch for

A local privilege escalation flaw of this kind is mainly a risk to machines where an attacker already has some access, such as through malware or a shared computer. Gaining System rights lets malicious software disable security tools, install persistent backdoors and reach everything on the device.

There is no patch mentioned in the reporting, and Microsoft has not commented. Readers should keep their systems updated through normal channels and watch for an official Microsoft advisory. The registry check described above can show whether a given machine is exposed.