Windows SignDrop zero-day grants SYSTEM privileges via CLFS
Original title: New Windows SignDrop zero-day gives hackers SYSTEM privileges
Researcher Abdelhamid Naceri published a PoC; Microsoft has no patch, and he estimates 80% of Windows installs are vulnerable.
Abdelhamid Naceri released SignDrop, a Windows local privilege-escalation zero-day that abuses an October 2025 CLFS authentication mitigation. A privileged process such as Windows Defender can be forced to open a log file so the .cnpf authentication file is created as SYSTEM with the original file's permissions, also bypassing antimalware tamper protection. He tested Windows 11 26H2, Windows 11 26H2 Experimental and Windows Server 2025 Experimental. He says the only fix is waiting for a Microsoft patch, because disabling the mitigation would re-expose memory-corruption attacks.
Unconfirmed: The 80% exposure figure is Naceri's estimate; Microsoft has not confirmed the flaw or attacks.
- CLFS access checks can be abused when a privileged process later opens the log.
- A registry Mode of 0 or 1 means the machine is vulnerable.
- A SYSTEM shell from the PoC indicates the device is affected.
- Naceri says he is a former Microsoft employee and has disclosed other unpatched zero-days.
Impact: Local elevation to SYSTEM and antivirus tamper-protection bypass
| Product | Affected |
|---|---|
| Microsoft Windows | Windows 11 26H2, Windows 11 26H2 Experimental, Windows Server 2025 Experimental |
- 1.Wait for a Microsoft patch; do not disable the CLFS mitigation.
- 2.Check HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode; 0 or 1 means vulnerable.
From the original article
3 min read at bleepingcomputer.com
Security researcher Abdelhamid Naceri (also known as Nightmare Eclipse) has released a new Windows zero-day exploit that can let attackers gain SYSTEM privileges. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.