A researcher going by the name Nightmare Eclipse on Tuesday disclosed a Windows vulnerability called SignDrop that allows ordinary local users to obtain full System rights on some versions of the operating system. The flaw is located in the Common Log File System, a general-purpose logging service that Microsoft says is used by software clients running in either user mode or kernel mode. An attacker who forces a privileged process, such as Windows Defender, to open a crafted CLFS container can exploit privileged file creation to elevate to System. The disclosure affects users of Windows 11 26H2, Windows 11 26H2 Experimental and Windows Server 2025 Experimental, according to the researcher.
The attack depends on how CLFS, Windows Defender and Windows file permissions interact. The exploit calls ServerMpUpdateEngineSignature, a legitimate Defender function for processing antivirus signature updates, to make Defender open a log file created by a standard user. By manipulating Windows Object Manager symbolic links, the attacker causes Defender to open the CLFS container in the security context of its antimalware engine. If the related authentication file is absent, CLFS creates it using Defender's System privileges, and because CLFS gives the new file the discretionary access control list of the original file, the attacker can reach a file created with System rights, turning the file-creation step into a privilege-escalation attack.
Nightmare Eclipse noted that the vulnerability stems from a security mitigation Microsoft introduced in October 2025 to stop attackers from abusing other CLFS flaws. The researcher wrote that when the chain is assembled correctly, this legitimate mitigation can be turned against itself to permit elevation, and that Microsoft handled each step properly but the underlying logic can be abused. The researcher added that the technique can be aimed at any antimalware engine to get past its self-defense or tamper protection, because the file creation happens in the context of the vendor's own process and passes the checks of its kernel drivers. According to Nightmare Eclipse, this makes the flaw unusual in that it can be used to turn off any antivirus or EDR product.
Researcher Will Dormann said in an interview that he reproduced the exploit and that it works as described, though not on every version of Windows 11. He said the requirements matter because the flaw appears to need Windows 26H2 and a system that has existed for more than 90 days, so a fresh 26H2 machine with updates installed will not necessarily be affected. Dormann said the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode value must be 0 or 1 for a system to be vulnerable, and that only one of the many machines he uses met that condition.
Users can check whether CLFS authentication is in learning mode or enforcement mode, which the researcher says indicates a vulnerable system, and the proof-of-concept in the post should produce a SYSTEM shell. Microsoft said in a statement issued after the post went live that it is investigating the writeup and has no evidence the vulnerability is being exploited in the wild, and that Defender blocks potential exploitation attempts. Microsoft distributes Windows updates such as 26H2 in staged rollouts, so the number of affected systems is unclear; users can check their version with the winver command. Nightmare Eclipse has published numerous other Windows zero-days in recent months.
More cybersecurity news from TechManNews.
