New SignDrop Zero-Day Exploit Targets Windows CLFS Security Feature
Security researcher reveals exploit allowing local users to gain SYSTEM privileges on Windows.
1SignDrop Zero-Day Vulnerability
A new proof-of-concept exploit named SignDrop targets the Windows Common Log File System driver. The researcher MSNightmare released code on GitHub this week, claiming it allows local users to gain SYSTEM privileges. Microsoft has not yet confirmed the flaw, assigned a CVE identifier, or released any security patches for this specific issue.
2Exploiting Log Authentication
The exploit targets a security feature added to the CLFS driver in October 2025 for Windows 11 and Server 2025. This feature uses hash-based message authentication codes to verify log files. SignDrop abuses the creation process of companion .cnpf recovery files, which are generated with the same security attributes as the original log.
3Path Redirection Mechanism
Attackers use object manager symbolic links to redirect the creation of the .cnpf file to a location they control. When a privileged process, such as the Defender antimalware service, opens a prepared log, the driver creates the file in that privileged context. This allows standard users to write to a SYSTEM-level file.
4Scope of Affected Systems
The exploit affects Windows 11 26H2 and Windows Server 2025 experimental builds. Systems are vulnerable when the CLFS authentication registry mode is set to 0 or 1. Established installations typically default to these modes after 90 days, making them primary targets for this specific privilege escalation technique discovered by the researcher.
5Operational Reliability Concerns
Security firm 78researchlab confirmed the exploit works, but researcher Heewon Song noted it lacks the reliability required for operational use. The attack triggers UAC prompts for both standard and SYSTEM shells, making the activity highly visible to any user at the machine. The broader claim regarding other antimalware engines remains currently untested.
6Registry Mitigation Trade-offs
Administrators can disable the mitigation by setting the registry mode to 2 or 3, but this is discouraged. Disabling the feature allows the CLFS driver to parse tampered log files, potentially reopening older memory corruption vulnerabilities. The vendor documentation warns that this configuration removes essential protections against known, dangerous log-based attack vectors.
7Researcher's Track Record
The researcher behind SignDrop has disclosed multiple Windows and Defender vulnerabilities since April. Previous exploits like RoguePlanet and ShieldBreak were confirmed by Microsoft and assigned CVEs, with some being actively exploited in the wild. Unlike those race condition flaws, SignDrop specifically targets the logic of the driver's own authentication feature.
8Monitoring Future Security Updates
As of the November security updates, no official advisory or patch exists for SignDrop. Administrators should monitor the vendor's security update guide for future responses. Organizations can verify their current exposure by checking the HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication registry key to see if their systems are running in the vulnerable enforcement modes.