New Windows SignDrop Zero-Day Bypasses Antivirus to Grant System Rights
A Windows zero-day vulnerability granting local users full system rights was disclosed on Tuesday by a researcher who uses the pseudonym Nightmare Eclipse.
The Tech TL;DR:
- Nightmare Eclipse released SignDrop, a Common Log File System (CLFS) vulnerability giving local users full System rights on specific Windows versions.
- Researcher Will Dormann reproduced the exploit, noting it targets Windows 11 26H2 installations existing for more than 90 days.
- Microsoft stated it is investigating the vulnerability, has no evidence of active exploitation, and said that Windows Defender blocks potential exploitation attempts.
Microsoft characterizes the Common Log File System—where the bug is located—as a versatile logging mechanism utilized by software clients operating in either user-mode or kernel-mode. As Ars Technica reported, an attacker possessing standard user privileges can leverage privileged file creation by compelling a high-privilege process like Windows Defender to open a specially prepared CLFS container, thereby escalating their privileges to System level.
Nightmare Eclipse said that the exploit works against Windows 11 26H2, Windows 11 26H2 Experimental, and Windows Server 2025 Experimental. The researcher added that the flaw bypasses antimalware self-defense mechanisms by triggering arbitrary file creation within the context of the antivirus process itself.
In an interview, researcher Will Dormann confirmed that he successfully verified the exploit functions as claimed, though its effectiveness is limited to certain Windows 11 editions rather than all of them. Specific system requirements limit the vulnerability surface.
“The requirements are important in that it seems to require Windows 26H2, and one that has existed for more than 90 days, it seems. That is, you can’t just take a new 26H2 system and install updates and have it work,” said Will Dormann, researcher.
For a system to be vulnerable, Dormann said that the registry value at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode must be 0 or 1. Out of many machines tested, Dormann found only a single system meeting this requirement.
Microsoft stated in a release that it was investigating the writeup and had no evidence the vulnerability was being exploited in the wild. The company added that Windows Defender blocks potential exploitation attempts.
reg query HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication /v ModeAdministrators can check their system configuration using the Windows version utility via the winver command or inspect the CLFS authentication registry key directly to determine exposure.
Always consult with certified IT and cybersecurity professionals before altering enterprise networks or handling sensitive data.