THE CRUNCH
Security researcher Abdelhamid Naceri, known online as Nightmare Eclipse, has published a new zero-day exploit for Windows called SignDrop. The proof of concept lets a local user escalate their privileges to System by abusing flawed logic in the Windows Common Log File System (CLFS), the kernel-mode component that parses complex log files and has long been a favourite target for attackers.
The exploit chains two weaknesses. It takes advantage of how clfs.sys handles the creation of the '.cnpf' authentication file when a log file is created, and it abuses Windows Defender to trigger arbitrary file creation in the context of the antimalware process. A standard user can create a log file pointing to a chosen container, then coerce Defender to open it via the signature update RPC interface; if the signature file is absent, Defender creates one with System privileges at an attacker-controlled location, which the exploit then reopens to plant a payload and spawn a System shell, according to reporting on the code.
Microsoft introduced CLFS logfile authentication last year, using authentication codes to check file integrity, but SignDrop targets a flaw in how that authentication file is handled during log creation. Naceri says the exploit has been tested on Windows 11 26H2, Windows 11 26H2 Experimental and Windows Server 2025 Experimental, and should work on roughly 80% of Windows installations, with systems older than 90 days generally vulnerable.
Cybersecurity services provider Cyderes, which compiled and tested the proof of concept, says there is no evidence the zero-day has been exploited in the wild. SecurityWeek has not tested the code itself and has contacted Microsoft for comment.