New SignDrop exploit abuses Windows CLFS driver to escalate local user privileges to SYSTEM
A newly released proof-of-concept exploit named SignDrop leverages a logic flaw in the Windows Common Log File System (CLFS) driver's log authentication feature to escalate a local user to SYSTEM privileges. The exploit manipulates the creation of companion .cnpf files during privileged log access by using symbolic link path redirection, causing files to be created in the security context of a privileged process such as Windows Defender. This creates SYSTEM-level writable files accessible by standard users, enabling privilege escalation. Despite the release of public exploit code and a detailed writeup by researcher MSNightmare, Microsoft has not confirmed the vulnerability, assigned a CVE, or issued a patch as of November 2026 updates. The exploit targets Windows 11 versions 25H2, 26H1, 26H2, and Windows Server 2025 with CLFS authentication enabled (mode 0 or 1). Testing showed the exploit as effective but not reliably operational, and it requires Defender to be enabled. There have been no reported in-the-wild attacks exploiting SignDrop to date. Administrators can assess exposure via the CLFS Authentication registry setting. This vulnerability differs from previous Defender-related exploits by targeting the CLFS driver's authentication mechanism rather than Defender's file handling race conditions. Users should monitor for official advisories and patches from Microsoft.
Entenda a falha
A vulnerabilidade
SignDrop is a claimed logic flaw in the Windows Common Log File System driver (clfs.sys), in the log-authentication feature Microsoft added in late 2025. A local standard user can get SYSTEM privileges. The article lists Windows 11 25H2, 26H1 and 26H2 and Windows Server 2025 as affected, with the CLFS authentication registry mode set to 0 (enforced) or 1 (learning). The published chain also needs Defender enabled. Microsoft has not confirmed the flaw, assigned a CVE or released a patch, including in the November 2026 updates, so no fixed version exists.
Como funciona
A standard user prepares a CLFS log and container using paths the user controls. A privileged process, which in the published code is the Defender antimalware service triggered through its update interface, later opens that log. The driver then creates the companion .cnpf recovery file in the privileged process's security context instead of the user's. Object manager symbolic links redirect that file creation to a location the attacker chooses. The file inherits the original log's permissions, so the result is a SYSTEM-created file that the standard user can write to, which the researcher says can be chained into a SYSTEM shell.
Por que é vulnerável
The authentication feature itself works as designed. The problem is a logic gap: the .cnpf companion file is created with the same security attributes as the original log, but the driver creates it in the context of whichever privileged process opens the log. A user-controlled log and path redirection can therefore make a privileged process create and hand over a file the user can write. The researcher wrote that Microsoft did everything properly but the logic allows abuse. No fix exists yet, so the articles do not say what a fix would change.
Onde está
The articles place the flaw in clfs.sys, in the creation of the companion .cnpf file during CLFS log authentication; no commit or fix is named.
Como foi descoberta
The researcher known as MSNightmare released the exploit and a detailed writeup on GitHub on Tuesday, the same day Microsoft published its November security updates. There is no indication of coordinated disclosure or prior vendor notice. The same researcher has published a series of Windows and Defender exploits since April, some of which Microsoft later assigned CVEs, such as RoguePlanet (CVE-2026-50656) and ShieldBreak (CVE-2026-69414). No in-the-wild attacks with SignDrop have been reported, and it is not in the CISA KEV catalog.
PoC pública
A public proof of concept and writeup are on GitHub. Sungyup Nam of 78researchlab said his colleague Heewon Song tested it and found it works but is not reliable enough for operational use. It was tested on Windows 11 26H2, a 26H2 Experimental build and Windows Server 2025 Experimental, and needs Defender enabled. Running it turns every UAC prompt into a standard user shell plus a SYSTEM shell, which makes it noticeable. The claim that it works against any elevated antimalware engine is untested. Urgency is moderate: no patch exists, so administrators should check the CLFS Authentication Mode registry value and watch for a Microsoft advisory.
Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 16:15.
Linha do tempo
-
New SignDrop exploit abuses Windows CLFS driver to escalate local user privileges to SYSTEM
ler a análise desta fonte ocultar
A newly released proof-of-concept exploit named SignDrop leverages a logic flaw in the Windows Common Log File System (CLFS) driver's log authentication feature to escalate a local user to SYSTEM privileges. The exploit manipulates the creation of companion .cnpf files during privileged log access by using symbolic link path redirection, causing files to be created in the security context of a privileged process such as Windows Defender. This creates SYSTEM-level writable files accessible by standard users, enabling privilege escalation. Despite the release of public exploit code and a detailed writeup by researcher MSNightmare, Microsoft has not confirmed the vulnerability, assigned a CVE, or issued a patch as of November 2026 updates. The exploit targets Windows 11 versions 25H2, 26H1, 26H2, and Windows Server 2025 with CLFS authentication enabled (mode 0 or 1). Testing showed the exploit as effective but not reliably operational, and it requires Defender to be enabled. There have been no reported in-the-wild attacks exploiting SignDrop to date. Administrators can assess exposure via the CLFS Authentication registry setting. This vulnerability differs from previous Defender-related exploits by targeting the CLFS driver's authentication mechanism rather than Defender's file handling race conditions. Users should monitor for official advisories and patches from Microsoft.