Unpatched Windows SignDrop PoC escalates a user to SYSTEM
Original title: New Windows SignDrop Zero-Day Exploit Allows Attackers to Gain SYSTEM Privileges
The local CLFS proof of concept has no CVE or Microsoft patch, and no in-the-wild attacks are reported.
Researcher MSNightmare published a GitHub proof of concept on November 10 for SignDrop, an unpatched local privilege escalation in the Windows CLFS driver. A standard user can coerce Microsoft Defender into opening a crafted log container so CLFS creates an attacker-controlled authentication file as SYSTEM. Microsoft has not confirmed the issue. The researcher says authentication modes 0 and 1 are vulnerable and tested Windows 11 26H2 and Windows Server 2025 builds.
Unconfirmed: Microsoft has not confirmed the flaw, and the estimate that about 80% of installations are exposed is the researcher's figure.
- The PoC appeared the same day as Microsoft's monthly updates and still has no advisory.
- An empty associated container is signed even if a signature file already exists.
- The researcher estimates 80% of Windows installations are exposed; that is not a measured count.
- Attackers need existing local code execution before the flaw can be used.
- Disabling the CLFS HMAC mitigation is not a recommended workaround.
Impact: local escalation from a standard user to SYSTEM
| Product | Affected |
|---|---|
| Microsoft Windows | Windows 11 26H2 and Windows Server 2025 builds tested; CLFS authentication modes 0 and 1 |
- 1.Do not turn off the CLFS authentication mitigation as a workaround.
- 2.Monitor unexpected .cnpf file creation by Defender or other privileged processes.
- 3.Watch for ERROR_LOG_METADATA_CORRUPT errors and apply Microsoft's fix when it ships.
- Vendors
- Microsoft
From the original article
3 min read at gbhackers.com
A researcher known as MSNightmare, also called Chaotic Eclipse, has published a working proof of concept for an unpatched Windows zero-day dubbed SignDrop. The exploit turns a standard user account into NT AUTHORITY\SYSTEM by abusing the Common Log File System (CLFS) driver, clfs. sys.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.