Nightmare Eclipse releases SignDrop, a Windows local privilege escalation zero-day exploit
Security researcher Abdelhamid Naceri, known as Nightmare Eclipse, has released a zero-day exploit named SignDrop targeting a local privilege escalation vulnerability in Windows. The exploit abuses flawed logic in the Windows Common Log File System (CLFS) to elevate privileges to System by manipulating the creation of authentication files (.cnpf) used for log file integrity verification. Tested successfully on Windows 11 26H2 and Windows Server 2025 Experimental versions, SignDrop is believed to affect approximately 80% of Windows installations worldwide, particularly those older than 90 days. There is currently no evidence of exploitation in the wild. Microsoft has been contacted for comment but has not yet issued a statement.
Entenda a falha
A vulnerabilidade
SignDrop is an unpatched local privilege escalation flaw in the Windows Common Log File System (CLFS) driver, clfs.sys. It has no CVE. A local standard user can reach System privileges. The researcher says it works on Windows 11 26H2 and Windows Server 2025 Experimental builds and should affect about 80% of Windows installs, generally those older than 90 days. No fixed version exists, and Microsoft had not commented when the articles were published.
Como funciona
When a log file is created, CLFS also handles its container, and opening the log file always opens the container. If the container is empty, CLFS tries to sign it whether or not a signature file (.cnpf) already exists. A standard user can create a log file whose container points to a path they choose. They then make Windows Defender open it through the signature update RPC interface. Defender uses the path from the container, and if no signature file is there, one is created with System privileges at that location.
Por que é vulnerável
The cause is flawed logic in how clfs.sys creates the authentication file. It signs an empty container without checking whether a signature file exists, and it trusts the container path set by an unprivileged user. As a result, a privileged process (Defender, running as System) creates a file at an attacker-controlled location. CLFS log authentication was added last year to harden the driver, and this flaw sits in that mechanism. No fix has been described.
Onde está
The articles place the flaw in clfs.sys, in the code that creates the .cnpf authentication file when a log file and its container are created or opened, reached through Defender's signature update RPC interface.
Como foi descoberta
Researcher Abdelhamid Naceri, known as Nightmare Eclipse, released the exploit as a zero-day, so there was no coordinated disclosure or advisory. The articles do not say how he found the flaw. Cyderes compiled and tested the PoC and found no evidence of exploitation in the wild. SecurityWeek emailed Microsoft for comment and had received no reply.
PoC pública
A working exploit was released by Naceri, and Cyderes successfully compiled and tested it. According to SecurityWeek, which did not test it, the code abuses the mechanism to create a signature file at an attacker-controlled location, then reopens the file to place a payload, which spawns a System shell. Naceri reports it works on Windows 11 26H2 and Windows Server 2025 Experimental. With a public working exploit and no patch, urgency is high even though no in-the-wild use has been seen. The articles give no link to the code.
Explicação gerada por IA a partir da matéria e dos artigos, em 13/11/2026 06:16.
Linha do tempo
-
Nightmare Eclipse releases SignDrop, a Windows local privilege escalation zero-day exploit
ler a análise desta fonte ocultar
Security researcher Abdelhamid Naceri, known as Nightmare Eclipse, has released a zero-day exploit named SignDrop targeting a local privilege escalation vulnerability in Windows. The exploit abuses flawed logic in the Windows Common Log File System (CLFS) to elevate privileges to System by manipulating the creation of authentication files (
.cnpf) used for log file integrity verification. Tested successfully on Windows 11 26H2 and Windows Server 2025 Experimental versions, SignDrop is believed to affect approximately 80% of Windows installations worldwide, particularly those older than 90 days. There is currently no evidence of exploitation in the wild. Microsoft has been contacted for comment but has not yet issued a statement.