SignDrop PoC abuses Windows CLFS mitigation for local SYSTEM access
Original title: New SignDrop Exploit Can Abuse Windows Defender to Bypass Security Protections
A public proof of concept coerces Windows Defender into creating a privileged CLFS authentication file; Microsoft has not patched it.
Researcher Chaotic Eclipse published a GitHub proof of concept for SignDrop, a Windows local privilege-escalation zero-day in clfs.sys. The bug abuses Microsoft’s staged CLFS authentication mitigation, rolled out from October 28, 2025, while systems remain in the 90-day learning period. A standard user can coerce Windows Defender, via ServerMpUpdateEngineSignature and Object Manager symbolic links, into creating an authentication file as SYSTEM. The researcher says the same coercion can bypass tamper protection in other antimalware products. No patch is available, and disabling the mitigation restores exposure to older CLFS memory-corruption bugs.
Unconfirmed: The roughly 80% exposure figure is the researcher’s estimate, and Microsoft has not confirmed the flaw.
- Registry Mode 0 or 1 under CLFS Authentication means vulnerable; 2 or 3 means protected.
- The researcher estimates about 80% of Windows installations are affected.
- Testing covered Windows 11 26H2, 26H2 Experimental, and Windows Server 2025 Experimental.
- CLFS access checks use OBJ_FORCE_ACCESS_CHECK for a process’s own log files.
- The researcher says he is Abdelhamid Naceri, known for prior public zero-day PoCs.
Impact: Local user gains SYSTEM and can bypass AV tamper protection
| Product | Affected |
|---|---|
| Microsoft Windows | Installations still in the 90-day CLFS learning period; tested on Windows 11 26H2, Windows 11 26H2 Experimental, and Windows Server 2025 Experimental |
- 1.Check HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode; 0 or 1 is vulnerable.
- 2.Do not disable the CLFS authentication mitigation while waiting for a Microsoft patch.
- Vendors
- Microsoft
- Products
- WindowsWindows Defenderclfs.sys
- Malware
- SignDrop
From the original article
5 min read at securityaffairs.com
SignDrop is a Windows zero-day that abuses CLFS security protections to let local attackers gain SYSTEM privileges and bypass defenses. The researcher Chaotic Eclipse, also known as INFINITE NIGHTMARE, MSNightmare, Nightmare-Eclipse, and MSNightmare, published a proof-of-concept for a new Windows local privilege escalation zero-day, naming it SignDrop. The flaw sits inside the mitigation Microsoft rolled out […]
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.