Researcher discloses SignDrop, a Windows CLFS zero-day to System
Original title: Windows 0-day dropped by disgruntled researcher hands hackers System rights
A local user can force Windows Defender to create a CLFS file as System; no Microsoft fix is named.
Researcher Nightmare Eclipse disclosed SignDrop on Tuesday, a local privilege-escalation flaw in the Common Log File System on some Windows versions. An ordinary user can make Windows Defender open a crafted CLFS container via ServerMpUpdateEngineSignature, then abuse symbolic links so CLFS creates an authentication file with Defender’s System rights and the attacker’s access control list. The researcher says the bug abuses a mitigation Microsoft added in October 2025. No patch or CVE is named.
Unconfirmed: The report does not say which Windows versions are affected or whether attackers are using SignDrop.
- The flaw is in CLFS and is triggered through Windows Defender.
- The researcher says an October 2025 CLFS mitigation can be turned against itself.
- No affected build list, CVE, or fixed version is given.
Impact: local elevation from user rights to System
| Product | Affected |
|---|---|
| Microsoft Windows | some versions |
- Vendors
- Microsoft
From the original article
1 min read at arstechnica.com
"SignDrop" exploit lets local users gain all-powerful System rights.
By Dan Goodin · arstechnica.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.