New Windows SignDrop zero-day gives hackers SYSTEM privileges - BleepingComputer
Security researcher Abdelhamid Naceri has released a Windows zero-day exploit called SignDrop that allows attackers to gain SYSTEM privileges by abusing Microsoft's own security measures.
Named SignDrop, the exploit takes advantage of mitigations Microsoft introduced in October 2025 to defend against authentication attacks targeting vulnerabilities in the Common Log File System (CLFS) driver. Naceri noted that while attacks exploiting CLFS vulnerabilities decreased after the mitigation, Microsoft's protection itself introduced this new vulnerability.
The flaw exists in how CLFS handles creating authentication files (".cnpf") when generating new log files. Although CLFS properly enforces access checks initially, the logic can be manipulated if a privileged process later opens the log file.
Related
