New SignDrop zero-day in Windows gives attackers SYSTEM privileges
The SignDrop zero-day vulnerability in Windows allows attackers to elevate privileges to SYSTEM, exploiting a CLFS mitigation Microsoft introduced in October 2025.
- SignDrop is a new Windows zero-day disclosed by security researcher Abdelhamid Naceri (Nightmare Eclipse), allowing privilege escalation to SYSTEM.
- The flaw exploits the mitigation introduced by Microsoft in October 2025 to protect the CLFS driver.
- This technique can be used to disable tamper protection in antivirus and EDR solutions.
- Naceri estimates that around 80% of Windows installations could be vulnerable.
- There is currently no official patch available, leaving users waiting for Microsoft to issue an update.
Table of Contents
SignDrop exploits CLFS mitigations
Security researcher Abdelhamid Naceri (also known as Nightmare Eclipse) has disclosed SignDrop, a zero-day exploit in Windows that allows attackers to gain SYSTEM privileges. The vulnerability abuses a mitigation Microsoft introduced in October 2025 to block authentication-based attacks targeting the Common Log File System (CLFS) driver.
According to Naceri, the volume of CLFS exploit attempts dropped sharply following the rollout of this mitigation. However, the mitigation itself introduced a new security hole. The flaw stems from the way CLFS creates authentication files (.cnpf extension) when initializing a log file. While CLFS initially checks access permissions properly, this logic can be abused if a privileged process subsequently opens the log file.
Naceri noted that privileged processes such as Windows Defender can be coerced into opening these files. When that happens, the authentication file is created with SYSTEM privileges because CLFS applies the access rights of the original file. He observed that while Microsoft implemented the mechanism correctly, "the logic allows abuse."
Ability to disable antivirus and EDR
The technique can be leveraged to bypass tamper protection across any antimalware engine. Because the file creation request appears to originate from the engine's own legitimate process, its kernel drivers allow it through. According to Naceri, this is what sets SignDrop apart, as it can be used to disable any antivirus or EDR software.
SignDrop does not affect all Windows installations. Naceri tested the exploit on Windows 11 26H2, Windows 11 26H2 Experimental, and Windows Server 2025 Experimental. He estimates that 80% of Windows installations are potentially vulnerable. To check, users can run the proof-of-concept (PoC) code or inspect the registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode.
If the PoC opens a SYSTEM shell, the machine is vulnerable. A registry value of 0 or 1 (learning mode or enforcement mode) also indicates that the system is at risk.
No official patch yet
According to Naceri, there is currently no workaround other than waiting for a security update from Microsoft. Disabling the CLFS mitigation would leave devices exposed to memory corruption vulnerabilities.
Since April, Naceri (who claims to be a former Microsoft employee) has disclosed several other zero-days in Microsoft Defender, BitLocker, and other Windows components. The list includes BigDiskBuster, ShieldCrash, ShieldBreak, LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend. Microsoft has patched several of these, including ShieldBreak, RoguePlanet, YellowKey, GreenPlasma, and MiniPlasma. The remaining vulnerabilities have yet to receive an official fix.
SignDrop demonstrates how a security defense can turn into a weakness when its underlying logic fails to anticipate every scenario. For enterprises, system administrators should closely monitor upcoming Microsoft security updates and verify the CLFS registry value on their machines. Administrators should avoid disabling the CLFS mitigation, as doing so opens the door to other attack vectors. Keep in mind that details regarding the scope of impact currently stem primarily from the researcher, with no official confirmation yet from Microsoft.
Source: BleepingComputer
Reviewed by: Hero Association
