SignDrop Windows Zero Day Exploit Grants Local Users System Rights

A researcher known under the pseudonym Nightmare Eclipse has disclosed a new unpatched Windows zero-day vulnerability dubbed SignDrop. Revealed on Tuesday, the flaw allows local users to attain full System privileges on specific versions of the operating system by targeting the Common Log File System.

According to the details, the vulnerability involves forcing a privileged process, such as Windows Defender, to open a crafted CLFS container. An attacker with ordinary user rights can manipulate Windows Object Manager symbolic links, causing Defender to open the container in the security context of the antimalware engine. When an associated authentication file is missing, CLFS creates it using the system privileges of Defender.

“If everything is chained correctly, funnily this legit security mitigation can be used against itself and allow an elevation [of] privileges,” Nightmare Eclipse wrote. The researcher added that “everything is done properly by Microsoft here but the logic allows abuse.”

Vulnerability Scope and Verification

The flaw reportedly affects Windows 11 26H2, Windows 11 26H2 Experimental, and Windows Server 2025 Experimental. Systems can be checked by reviewing the CLFS authentication mode, where learning or enforcement modes indicate vulnerability.

Researcher Will Dormann stated in an interview that he successfully reproduced the exploit, confirming it works as described though not across all versions of Windows 11. Dormann noted that specific requirements apply, explaining that “the requirements are important in that it seems to require Windows 26H2, and one that has existed for more than 90 days, it seems.”

Dormann further noted, “That is, you can’t just take a new 26H2 system and install updates and have it work.” Representatives for Microsoft did not respond to an email seeking comment on the disclosure.