SignDrop Windows zero-day allows privilege escalation to SYSTEM via CLFS authentication flaw
Security researcher Abdelhamid Naceri disclosed a new Windows zero-day vulnerability named SignDrop that enables attackers to gain SYSTEM privileges by abusing mitigations Microsoft implemented in October 2025 for the Common Log File System (CLFS) driver. The vulnerability arises from how CLFS handles authentication file creation when a privileged process later accesses the log file, allowing an attacker to create a file with SYSTEM-level access. This flaw can bypass tamper protection mechanisms of antivirus and endpoint detection and response (EDR) engines, effectively turning their own self-defense against them. The exploit has been tested successfully on Windows 11 26H2 and Windows Server 2025 Experimental editions, with an estimated 80% of Windows installations vulnerable. Currently, there is no patch, and the only mitigation alternatives expose devices to other risks from memory corruption exploits. The researcher published a proof-of-concept (PoC) for detection and recommends checking the relevant registry key to assess vulnerability. Naceri has a history of disclosing Windows zero-days, some of which Microsoft has patched, though others remain unpatched. Microsoft has warned against malicious exploitation but has not yet addressed this particular issue.
Entenda a falha
A vulnerabilidade
SignDrop (no CVE assigned) is a Windows privilege-escalation zero-day in the Common Log File System (CLFS) driver. It abuses the authentication mitigation Microsoft added in October 2025 and lets a local attacker obtain SYSTEM. It was tested on Windows 11 26H2, 26H2 Experimental and Windows Server 2025 Experimental, and the researcher estimates 80% of Windows installations are vulnerable. There is no patch. Per the researcher, the registry value CLFS\Authentication\Mode set to 0 or 1 (learning or enforcement mode) means the machine is vulnerable. The technique can also turn off antivirus/EDR tamper protection.
Como funciona
When CLFS creates a new log file, it also creates an authentication file with the extension .cnpf. CLFS checks access correctly at the start. Later, a different privileged process, such as Windows Defender, can be forced to open the log file. At that point the authentication file is created in the context of that privileged process, with the original file's access permissions, so the result is a file with SYSTEM-level access. Because the request appears to come from the antimalware engine's own legitimate process, its kernel drivers let it through, which is how tamper protection is bypassed.
Por que é vulnerável
According to the researcher, Microsoft implemented the mitigation properly, but the logic around creating the authentication file can be abused. Access is checked at creation time, yet a privileged process that opens the log file later causes the file to be created with the original file's permissions. The mitigation itself therefore introduced the weakness. The articles describe no fix, since none exists yet.
Onde está
The CLFS driver's handling of the .cnpf authentication file creation, controlled by the registry value HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode; no file or function names are given.
Como foi descoberta
Researcher Abdelhamid Naceri (Nightmare Eclipse), who says he is a former Microsoft employee, publicly disclosed SignDrop as a zero-day, with no prior private report to Microsoft mentioned. He has disclosed many other Windows zero-days since April. Microsoft has fixed some of them, such as ShieldBreak, RoguePlanet, YellowKey, GreenPlasma and MiniPlasma, while others remain unpatched. Microsoft has warned of legal action against malicious activity that harms customers.
PoC pública
Naceri released a proof-of-concept exploit for SignDrop. He recommends running it to check exposure: if it spawns a SYSTEM shell, the machine is vulnerable. It is a working local privilege escalation, so with no patch available, treat it as urgent. Disabling the CLFS mitigation is not a good workaround, because it exposes devices to memory corruption exploits.
Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 15:16.
Linha do tempo
-
SignDrop Windows zero-day allows privilege escalation to SYSTEM via CLFS authentication flaw
ler a análise desta fonte ocultar
Security researcher Abdelhamid Naceri disclosed a new Windows zero-day vulnerability named SignDrop that enables attackers to gain SYSTEM privileges by abusing mitigations Microsoft implemented in October 2025 for the Common Log File System (CLFS) driver. The vulnerability arises from how CLFS handles authentication file creation when a privileged process later accesses the log file, allowing an attacker to create a file with SYSTEM-level access. This flaw can bypass tamper protection mechanisms of antivirus and endpoint detection and response (EDR) engines, effectively turning their own self-defense against them. The exploit has been tested successfully on Windows 11 26H2 and Windows Server 2025 Experimental editions, with an estimated 80% of Windows installations vulnerable. Currently, there is no patch, and the only mitigation alternatives expose devices to other risks from memory corruption exploits. The researcher published a proof-of-concept (PoC) for detection and recommends checking the relevant registry key to assess vulnerability. Naceri has a history of disclosing Windows zero-days, some of which Microsoft has patched, though others remain unpatched. Microsoft has warned against malicious exploitation but has not yet addressed this particular issue.