New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access - The Hacker News

The proof-of-concept, called SignDrop, targets a log-authentication feature added to the CLFS driver last year. It abuses how clfs.sys creates companion files when a privileged process opens a prepared log, using path redirection to take control of the operation. Microsoft has not confirmed the claimed flaw, assigned a CVE, or released a fix.

Authentication Feature Targeted

CLFS is a logging subsystem built into Windows. Its driver has been a frequent target for privilege escalation: 10 CLFS flaws appear in CISA's catalog of vulnerabilities known to have been exploited in attacks, including one used in ransomware campaigns in April 2025. To reduce that exposure, Microsoft added an authentication check to CLFS log files in updates for Windows 11 25H2, 26H1, and Windows Server 2025 shipped in October 2025.

The check attaches a hash-based message authentication code, built from log data and a key unique to each machine. The driver then parses only log files it wrote. A companion .cnpf file stores recovery data beside each log and is created with the same security attributes as the original.

Exploit Mechanics

SignDrop targets the creation of that companion file. According to the proof-of-concept code, a standard user prepares a CLFS log and container with paths the user controls. When a privileged process later opens that log, the driver creates the .cnpf file in the privileged process's security context rather than the user's.

The exploit uses object manager symbolic links to redirect that file creation to a location the attacker chooses. In the published code, the privileged process is the Defender antimalware service, triggered through its update interface. Because the .cnpf file inherits the original log's permissions, the result is a file created as SYSTEM that the standard user can write to.

Testing and Impact

The exploit was tested on Windows 11 26H2, a Windows 11 26H2 Experimental build, and Windows Server 2025 Experimental. Systems are affected when the CLFS authentication registry mode is set to 0 (enforced) or 1 (learning). Systems older than 90 days typically move from learning to enforcement automatically, so the default configuration on established installations is the one the exploit targets.

Sungyup Nam, head of research at Korean security firm 78researchlab, reported that researcher Heewon Song of the firm's PurpleHound offensive content team tested the exploit and found that it works. Song assessed that it does not run reliably enough for operational use. Defender must be enabled for the published chain to succeed.

Mitigation Status

No CVE, advisory, or patch for SignDrop appeared in the November security updates. The CISA Known Exploited Vulnerabilities catalog does not list it, and no attacks using the exploit have been reported. Administrators can check their exposure by reading the CLFS authentication mode at HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication, where a Mode value of 0 or 1 falls within the researcher's claimed scope.

The researcher has released a series of exploits targeting Windows and Defender since April. The vendor confirmed an earlier Defender exploit called RoguePlanet in June as CVE-2026-50656 and patched it the following month. The ShieldBreak bypass followed in August and was assigned CVE-2026-69414. Three of the researcher's earlier Defender flaws have been exploited in attacks.

SignDrop is a different class of issue. Where the earlier exploits targeted race conditions in Defender's file handling, this one targets the CLFS driver's own authentication feature. The vendor's security update guide is the place to watch for a response.