SignDrop zero-day can grant Windows attackers SYSTEM privileges

By Tom Whitfield

An estimated 80% of Windows installations are vulnerable to SignDrop, a publicly released Windows zero-day that can grant attackers SYSTEM privileges, according to Abdelhamid Naceri.

The researcher, also known as Nightmare Eclipse, says SignDrop attacks the logic behind a Microsoft mitigation introduced in October 2025 against authentication attacks targeting vulnerabilities in the Common Log File System (CLFS) driver. He said attacks exploiting CLFS vulnerabilities dropped sharply after the mitigation.

The mitigation then introduced a fresh privilege-escalation path. Microsoft reduced one attack class and opened another. The irony is structural.

SignDrop does not work against every Windows machine. Naceri tested the exploit on Windows 11 26H2, Windows 11 26H2 Experimental and Windows Server 2025 Experimental. His 80% estimate remains the central warning.

Naceri found the flaw in how CLFS handles creation of an authentication file, with a ".cnpf" extension, when it creates a new log file. The driver enforces access checks correctly at the start, but its logic permits abuse if a different privileged process later opens the log.

Windows Defender is one such process. Attackers can force the antimalware component to open the file, causing CLFS to create the authentication file with SYSTEM privileges and apply the original file's access permissions.

The request looks legitimate because it comes from the security product itself. "Everything is done properly by Microsoft here but the logic allows abuse," Naceri said.

That mechanism defeats self-defense, or tamper protection, across antimalware engines. The file-creation request appears to come from the engine's own valid process, so its kernel drivers accept it. Naceri said the technique can "be used to turn off any antivirus/EDR." A security control, turned against itself.

What does SignDrop change for Windows security teams?

For organizations, the immediate answer is that there is no vendor fix. Naceri says the only current solution is to wait for a Microsoft patch, because disabling the CLFS mitigation would expose devices to attacks exploiting memory-corruption vulnerabilities. There is no tidy administrative workaround here.

Naceri recommends two ways to test. Administrators can run the proof-of-concept exploit or inspect the CLFS authentication mode under the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode registry value.

If the proof of concept spawns a SYSTEM shell, the device is vulnerable. A registry value of 0 or 1 also indicates exposure; those settings correspond to learning mode and enforcement mode. The test is binary in a particularly literal sense.

SignDrop forms part of Naceri's broader Windows disclosure record. Naceri, who says he is a former Microsoft employee, has disclosed zero-day flaws in Microsoft Defender, BitLocker and other Windows components since April. Named examples include BigDiskBuster, ShieldCrash, ShieldBreak, LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma and UnDefend.

Five years ago, Naceri released several zero-day exploits that enabled privilege escalation across various Windows versions. He has again disclosed zero-days publicly without first attempting to report them privately to Microsoft. Microsoft warned of legal action against anyone engaging in malicious activity that causes real harm to its customers. Much of the infosec community read that response as a direct threat to security researchers.

Microsoft has patched some flaws Naceri disclosed since the start of the year, including ShieldBreak, RoguePlanet, YellowKey, GreenPlasma and MiniPlasma. Some disclosed zero-days still lack an official patch. SignDrop joins that queue, with its added distinction of turning antimalware tamper protection into the route to SYSTEM.

The practical change is straightforward: security teams can test for exposure, but Microsoft must close the CLFS design gap. Until then, SignDrop turns a successful mitigation into an attack primitive. That is an uncomfortable use of a security improvement.