SignDrop: unpatched Windows CLFS zero-day gives local users SYSTEM, public exploit available, no CVE or patch
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 12/11/2026 12:01; os links antigos trazem para cá.
Fontes: gbhackers.com ↗ securityonline.info ↗
A researcher known as MSNightmare (aka Chaotic Eclipse) disclosed SignDrop, an unpatched local privilege escalation zero-day in the Windows Common Log File System (CLFS) driver (clfs.sys). It lets a standard user obtain NT AUTHORITY\SYSTEM (gbhackers.com). A proof-of-concept exploit is public on GitHub and spawns a SYSTEM shell on Windows 11 26H2 and Windows Server builds (securityonline.info). As of 2026-11-12, no CVE or patch has been issued, and Microsoft has neither commented publicly nor confirmed the issue (securityonline.info, gbhackers.com). No in-the-wild exploitation has been reported. The flaw is local-only, so an attacker needs prior code execution, which makes it a likely second-stage step after phishing or malware (gbhackers.com).
Entenda a falha
A vulnerabilidade
SignDrop is an unpatched local privilege escalation zero-day in the Windows Common Log File System driver (clfs.sys), with no CVE. An attacker who already runs code as a standard user gets an NT AUTHORITY\SYSTEM shell. The researcher also claims it can disable antivirus/EDR tamper protection. It was tested on Windows 11 26H2 and Windows Server 2025 builds (securityonline.info calls some of them experimental). Hosts are exposed when the registry value HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode is 0 (enforced) or 1 (learning), not when it is 2 or 3. The 80% exposure figure is the researcher's estimate, with no data behind it. There is no patch, and Microsoft has not confirmed the issue.
Como funciona
When a CLFS log is created, the driver writes a ".cnpf" authentication file next to it, holding an HMAC that CLFS checks before opening logs. The attacker attaches extra containers to the log with the AddLogContainer API, and the driver always opens these associated containers with the log. If an associated container is empty, CLFS signs it whether or not a signature file already exists. This is harmless when the caller is the attacker's own process, since file creation uses the caller's context. It goes wrong when a privileged process opens the log: the researcher coerces Microsoft Defender into doing so through the ServerMpUpdateEngineSignature call, with the path redirected by object manager symbolic links. CLFS then creates the missing file as SYSTEM, and it inherits the original file's DACL, which the attacker controls.
Por que é vulnerável
The root cause is a logic flaw in the CLFS authentication safeguard Microsoft added after earlier CLFS exploitation (CVE-2025-29824). CLFS signs an empty associated container regardless of whether a signature file exists, assuming the opener is always the attacker's own process. That assumption breaks when a privileged process such as Defender is made to open the log through redirected paths: the file is created as SYSTEM but inherits attacker-controlled permissions. As the researcher puts it, Microsoft did everything properly but the logic allows abuse. No fix exists, so the articles describe no change. Disabling the mitigation is no workaround, since it re-exposes older CLFS memory-corruption bugs.
Onde está
The articles name the clfs.sys driver, the ".cnpf" authentication file, the AddLogContainer API, the ServerMpUpdateEngineSignature call and the registry value HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode; they name no function or commit.
Como foi descoberta
The researcher MSNightmare, also known as Chaotic Eclipse, disclosed SignDrop by publishing full details and a working exploit on GitHub on November 10, 2026, the same day as Microsoft's monthly updates. The articles do not say how the flaw was found or whether Microsoft was notified first. As of November 11-12 there was no CVE, advisory or patch, Microsoft had not commented or confirmed the claims, and no in-the-wild exploitation had been reported.
PoC pública
A working proof of concept is public on GitHub, with C++ source and a Visual Studio project. According to the researcher, it spawns a SYSTEM shell by chaining the CLFS signing behavior with a coerced Defender call and symbolic link redirection. It was tested on Windows 11 26H2 and Windows Server 2025 builds. Because it is a working exploit released before any patch, anyone with local code execution could reuse it, so urgency is high for hosts with CLFS authentication mode 0 or 1. Until a fix ships, rely on least privilege and monitoring for unexpected .cnpf creation by Defender and ERROR_LOG_METADATA_CORRUPT errors.
Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 12:16.
Detalhes técnicos
- The bug abuses the CLFS log-file signing/authentication mechanism, which was meant to block memory-corruption attacks, and turns it into a privilege escalation path (securityonline.info).
- The exploit coerces Microsoft Defender into creating an authentication file with SYSTEM privileges. The file inherits attacker-controlled permissions, which yields a SYSTEM shell (gbhackers.com).
- It may also bypass antivirus and EDR tamper protections, because the file creation appears to come from a trusted security engine (gbhackers.com).
- Affected: Windows 11 26H2 and Windows Server 2025 builds. About 80% of Windows installations are estimated to be exposed unless specific registry settings disable CLFS authentication enforcement (gbhackers.com). That figure is an estimate from a single source.
- Detection hints: unexpected ".cnpf" files created by Defender, and ERROR_LOG_METADATA_CORRUPT errors (gbhackers.com).
Remediação
- No official patch exists. Apply the Microsoft fix as soon as one ships.
- Enforce least privilege to limit the initial foothold needed (gbhackers.com).
- Monitor for the ".cnpf" file creations by Defender and the ERROR_LOG_METADATA_CORRUPT errors described above (gbhackers.com).
- Do not disable the existing CLFS mitigations. Doing so would re-expose hosts to other CLFS bugs (gbhackers.com).
- Previous CLFS flaws and mitigations can guide detection until an official fix is available (gbhackers.com).
Relatos divergentes
- Affected systems: securityonline.info (2026-11-11) lists Windows 11 26H2 and "experimental Windows Server builds". gbhackers.com (2026-11-12, more recent and more specific) names Windows 11 26H2 and Windows Server 2025.
- Mechanism: securityonline.info describes abuse of the log-file signing mechanism in general terms. gbhackers.com, the more detailed and recent source, describes Defender being coerced into creating a SYSTEM-owned authentication file. These descriptions are not necessarily contradictory.
Linha do tempo
-
New Windows SignDrop Zero-Day Elevates Local Users to SYSTEM via CLFS Driver
ler a análise desta fonte ocultar
A new unpatched local privilege escalation zero-day vulnerability called SignDrop has been disclosed by researcher MSNightmare (aka Chaotic Eclipse). The exploit abuses the Common Log File System (CLFS) driver (clfs.sys) on Windows to escalate an attacker from standard user to NT AUTHORITY\SYSTEM by manipulating authentication files created by CLFS logs. The exploit coerces Microsoft Defender to create an authentication file with SYSTEM privileges, inheriting attacker-controlled permissions, enabling a SYSTEM shell. It also potentially bypasses antivirus and EDR tamper protections by masquerading file creation as a trusted security engine’s action. The vulnerability affects Windows 11 26H2 and Windows Server 2025 builds, with an estimated 80% of Windows installations exposed unless specific registry settings disable CLFS authentication enforcement. As this is a local exploit, initial code execution is required, making it suitable as a second-stage privilege escalation after phishing or malware. No CVE or patch has been released yet, and Microsoft has not confirmed the issue or reported in-the-wild exploitation. Defenders are advised to enforce least privilege, monitor unexpected ".cnpf" file creations by Defender, watch for ERROR_LOG_METADATA_CORRUPT errors, and avoid disabling existing CLFS mitigations to prevent re-exposure to other bugs. Previous CLFS flaws and mitigations offer detection guidance until an official fix is available.
-
SignDrop Windows CLFS zero-day allows privilege escalation, exploit public
ler a análise desta fonte ocultar
A researcher known as MSNightmare disclosed a zero-day vulnerability in Windows CLFS that enables a standard user to gain SYSTEM privileges. This flaw exploits the log-file signing mechanism, which was intended to prevent memory corruption attacks, but is abused to turn the feature into a local privilege escalation path. The proof-of-concept exploit is now publicly available on GitHub, demonstrating how to spawn a SYSTEM shell on Windows 11 26H2 and experimental Windows Server builds. No patch has been issued yet, and no attacks are reported in the wild. Microsoft has not publicly commented.