SignDrop zero-day flaw turns Windows CLFS protection into a path to SYSTEM privileges

a triangle shaped sign on a yellow wall — Markus Spiske / Unsplash

A new zero-day vulnerability named SignDrop allows local privilege escalation on Windows systems by abusing the Common Log File System authentication mechanism. The flaw enables attackers to obtain SYSTEM privileges, a critical level of access that grants full control over the operating system. The vulnerability was disclosed by a security researcher known as Nightmare Eclipse, who published the exploit on November 10, 2026, coinciding with the monthly Patch Tuesday release cycle. As of the disclosure, no Common Vulnerabilities and Exposures identifier has been assigned, no security patch is available, and Microsoft has not yet confirmed the existence of the flaw.

The vulnerability resides in the authentication logic of the Common Log File System driver, specifically within the clfs.sys kernel component. Microsoft introduced an authentication mechanism to secure this subsystem, which is used by both applications and kernel components for logging. This protection, deployed in Windows 11 25H2 and Windows Server 2025 updates released from October 28, 2025, requires each log file to carry a Hash-based Message Authentication Code calculated from a system-specific key. Log files with missing or invalid codes are no longer opened. The SignDrop exploit does not break the cryptography itself but instead abuses the operational sequence involved in creating a companion file with the same security attributes as the log file. The researcher noted that while the implementation is technically correct, the logic permits this specific abuse.

The researcher, identified as Abdelhamid Naceri, has a history of publishing exploits targeting Windows, following a conflict with his former employer, Microsoft. His recent disclosures include BigDiskBuster in September 2026, a zero-day that prevented Microsoft Defender from updating. For SignDrop, the researcher tested the exploit on Windows 11 26H2 and experimental builds of Windows Server 2025. He estimated that 80 percent of Windows installations are exposed to this vulnerability. He also suggested the technique might be adaptable to other antivirus and endpoint detection and response solutions, though this remains unverified. Security researchers at Cyderes successfully compiled and executed the proof of concept, achieving a SYSTEM shell.

To determine if a machine is vulnerable, users should check the Mode value in the registry key associated with CLFS authentication. According to Microsoft documentation, a value of 0 indicates application mode, 1 indicates learning mode, and 2 indicates administrative deactivation. Machines set to values 0 or 1 are within the scope of the SignDrop vulnerability. Disabling the protection is not recommended as a temporary fix, because doing so would reopen older, well-known vulnerabilities in CLFS that allow the analysis of potentially malicious log files. The current lack of a patch leaves systems reliant on the authentication mechanism, creating a dilemma where disabling the new protection exposes users to older threats.