SignDrop Windows CLFS Zero-Day Details and Proof-of-Concept Exploit Published

Entenda a falha

A vulnerabilidade

SignDrop is an unpatched local privilege escalation zero-day in the Windows Common Log File System (CLFS) driver, clfs.sys. A standard local user can get SYSTEM, and the researcher also says it can be used to turn off any antivirus or EDR. No CVE has been assigned. Systems are affected when CLFS authentication is in learning or enforcement mode (registry Mode values 0 and 1), which covers most systems older than 90 days. The researcher tested Windows 11 26H2 and experimental builds of Windows 11 and Windows Server 2025, and claims about 80% of Windows installations are vulnerable, without supporting data. No fix exists yet.

Como funciona

Microsoft added HMAC authentication codes to CLFS log files, stored in a .cnpf authentication file, to block memory corruption attacks. During a 90-day learning period CLFS signs log files as they are opened, and afterwards it enforces the codes. When a log with an empty linked container is opened, clfs.sys creates the signature file whether or not one already exists. The researcher found a way to make a privileged process, such as Microsoft Defender, open a log prepared by a normal user. CLFS then creates the .cnpf file as SYSTEM, and that file inherits the permissions of the original file, which gives the low-privileged user a path to SYSTEM.

Por que é vulnerável

The root cause is a logic flaw in how clfs.sys creates the .cnpf authentication file: it signs a log with an empty linked container without checking whether a signature file already exists, and it creates the file with the permissions of the original file. The mitigation itself works as designed, and in the researcher's words everything is done properly by Microsoft but the logic allows abuse. The articles do not describe a fix. The researcher warns that turning the mitigation off is no answer, because it would expose machines to older CLFS memory corruption bugs.

Onde está

The flaw is in clfs.sys, in the code that creates the .cnpf authentication file, and it relates to the registry key HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication (Mode values 0 and 1).

Como foi descoberta

A researcher using the handle MSNightmare published full details and a working proof of concept on November 10, 2026, as an unpatched zero-day. The articles do not say how the flaw was found or whether Microsoft was told beforehand. No attacks in the wild have been reported, and Microsoft has not commented publicly.

Explicação gerada por IA a partir da matéria e dos artigos, em 11/11/2026 04:15.