SignDrop PoC claims unpatched local Windows CLFS escalation to SYSTEM

An unpatched SignDrop proof of concept claims local Windows user-to-SYSTEM escalation via CLFS, with no CVE and no confirmed attacks.

A GitHub proof of concept named SignDrop, published November 10, 2026, claims an unpatched local privilege escalation in the Windows CLFS driver. Cyber Security News and GBHackers attribute it to MSNightmare; BleepingComputer names Abdelhamid Naceri. According to the researcher, a standard user can coerce Microsoft Defender into opening a crafted log so CLFS creates an attacker-controlled authentication file as SYSTEM when authentication mode is 0 or 1. He estimates 80 percent of Windows installs are exposed and says the attack needs existing local code execution. Microsoft has issued no CVE, advisory, or patch, including in November updates, and no in-the-wild attacks are reported. The Hacker News says 78researchlab reproduced the issue but found it too unreliable for operational use.