New Windows SignDrop Zero-Day Flaw Lets Attackers Gain SYSTEM Privileges and Disable Antivirus - Cyber Press

A public proof-of-concept exploit named SignDrop targets the Common Log File System (CLFS) authentication mitigation in Windows. It converts a standard user token into NT AUTHORITY\SYSTEM and can blind antimalware engines. The vulnerability has no CVE identifier and no patch as of November 11, 2026, and Microsoft has not confirmed the claims.

A researcher using the handle MSNightmare, also known as Nightmare Eclipse, published the exploit code on GitHub on November 10, 2026. The repository claims the flaw sits in clfs.sys, specifically in how the driver creates the ".cnpf" authentication file when a log is created through the exposed \CLFS device object.

CLFS Vulnerability History

CLFS remains a favored kernel attack surface because it parses complex log structures in ring 0, where a single parsing error becomes memory corruption. The driver's history includes the CVE-2025-29824 zero-day used in ransomware intrusions, and the CVE-2023-36424 out-of-bounds read later added to CISA's Known Exploited Vulnerabilities catalog.

Microsoft countered this exposure by adding hash-based message authentication codes (HMAC) to CLFS logfiles. The codes combine file data with a system-unique key, and CLFS refuses to open logs that fail validation. This mitigation shipped in Windows 11 25H2 and Windows Server 2025 updates released on or after October 28, 2025.

Exploit Mechanism

SignDrop abuses the signing logic rather than breaking the cryptography. The attacker creates a .blf log and uses AddLogContainer to associate a second, empty container. CLFS signs that empty container even when no signature file exists. Because opening a log needs no special NtCreateFile flags, a privileged process can be coerced into opening it.

Mitigation and Impact

The researcher estimates that about 80 percent of Windows installations are exposed, though this is an estimate, not a measured count. The exploit works when the registry value Mode under HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication is 0 (enforced) or 1 (learning), but fails when the value is 2 or 3 (disabled).

Administrators should not set Mode to 2, as Microsoft says disabling the mitigation lets CLFS parse potentially corrupted or malicious logfiles, which restores the memory corruption exposure the control was designed to remove. Better options include restricting interactive and low-privilege code execution, monitoring unexpected .cnpf and .blf creation, and watching for ERROR_LOG_METADATA_CORRUPT errors. A fix will most likely arrive through a future Patch Tuesday cumulative update.