Nightmare Eclipse Drops Windows Zero-Day Exploit ‘SignDrop’
Security researcher Nightmare Eclipse has released a zero-day exploit called SignDrop that targets Windows systems, allowing local users to elevate privileges to System level.
The exploit, dubbed SignDrop, targets the Windows Common Log File System (CLFS), which parses complex log files in kernel mode. Nightmare Eclipse discovered that CLFS handles the creation of authentication files incorrectly, allowing standard users to escalate their privileges to System level.
Vulnerability Details
SignDrop exploits a flaw in how clfs.sys handles the creation of the '.cnpf' authentication file during log file creation. By coercing Windows Defender to open a file in the antimalware engine context, attackers can create signature files at attacker-controlled locations with System privileges.
You're generally vulnerable if your Windows installation is older than 90 days.
Affected Systems
The exploit has been tested on Windows 11 26H2, Windows 11 26H2 Experimental, and Windows Server 2025 Experimental. According to the researcher, it should work on approximately 80% of Windows installations worldwide.
Cybersecurity firm Cyderes has successfully compiled and tested the proof-of-concept exploit but found no evidence of it being used in the wild. Microsoft has been contacted for comment on the vulnerability.
Related
