Researcher drops SignDrop, a Windows CLFS local privilege zero-day
Original title: Nightmare Eclipse Drops Windows Zero-Day Exploit ‘SignDrop’
The public proof of concept elevates a standard user to System; Cyderes found no in-the-wild exploitation.
Abdelhamid Naceri, known as Nightmare Eclipse, published SignDrop, a local privilege-escalation exploit against Windows Common Log File System authentication. A standard user can steer Windows Defender into creating a CLFS signature file with System privileges and then place a payload that spawns a System shell. Naceri says it was tested on Windows 11 26H2, an experimental 26H2 build, and Windows Server 2025 Experimental. Cyderes compiled and ran the PoC and reports no evidence of exploitation in the wild. Microsoft had not commented when SecurityWeek published.
Unconfirmed: Naceri’s claim that SignDrop works on 80% of Windows installations is unconfirmed, and Microsoft has not responded.
- SignDrop abuses clfs.sys creation of the ‘.cnpf’ authentication file.
- Defender is coerced via the signature-update RPC interface.
- Tested builds include Windows 11 26H2 and Windows Server 2025 Experimental.
- Naceri says installs older than 90 days are generally vulnerable.
- Cyderes found no evidence the zero-day is exploited in the wild.
Impact: local user can elevate privileges to System
| Product | Affected |
|---|---|
| Microsoft Windows | Windows 11 26H2, Windows 11 26H2 Experimental, Windows Server 2025 Experimental; researcher says installs older than 90 days |
From the original article
2 min read at securityweek.com
It abuses CLFS and Windows Defender to trigger arbitrary file creation in the context of the antimalware process. The post Nightmare Eclipse Drops Windows Zero-Day Exploit ‘SignDrop’ appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.