New SignDrop Exploit Can Abuse Windows Defender to Bypass Security Protections - Security Affairs
Security researcher Chaotic Eclipse has discovered a Windows zero-day vulnerability named SignDrop that can abuse Windows Defender to bypass security protections and gain SYSTEM privileges.
Security researcher Chaotic Eclipse has published a proof-of-concept for a new Windows local privilege escalation zero-day vulnerability named SignDrop. The flaw specifically abuses the Common Log File System (CLFS) security protections introduced by Microsoft to let local attackers gain SYSTEM privileges and bypass Windows Defender security measures.
The vulnerability exists in the staged rollout of Microsoft's CLFS authentication mitigation, which was introduced starting October 28, 2025. The mitigation operates in two stages: a 90-day learning period followed by full protection. According to the researcher, approximately 80% of Windows installations worldwide may be affected because systems still in the learning period or with partially enabled mitigation remain vulnerable.
Technical Details
The bug resides in clfs.sys, specifically in how the driver creates the ".cnpf" authentication file tied to a new log container. While CLFS enforces access checks properly when a process creates its own log files, a dangerous loophole emerges when a different, more privileged process opens the file instead of the original caller.
This vulnerability won't affect all windows machines but I guess estimate 80% of the world's windows installations are vulnerable to this. To check, you need to run the proof of concept or check your registry configuration, if it spawns a SYSTEM shell, you're vulnerable.
Attackers can trick Windows Defender into opening the CLFS container by calling ServerMpUpdateEngineSignature and changing symbolic links in the Windows Object Manager. When Defender follows the path to find the associated file and creates a signature using SYSTEM privileges, CLFS creates the new authentication file using the original file's DACL, which defines access permissions.
Broader Implications
The consequences extend beyond privilege escalation because the same technique can be used against any antimalware engine, not just Defender. The researcher noted that the driver's file creation request appears to come from the antivirus's own legitimate process, allowing it to pass security checks and potentially disable self-defense mechanisms across different security products.
What makes it funnier is the fact that it can be used against any antimalware engine to bypass their self defense (or tamper protection) mechanism as you can trigger arbitrary file creation in the context of their own antimalware process so from the perspective of their kernel drivers, the file creation request is coming from their own legit process so it passes.
The researcher tested the proof-of-concept on Windows 11 26H2, Windows 11 26H2 Experimental, and Windows Server 2025 Experimental. There is currently no safe workaround, as disabling the CLFS authentication mitigation would expose systems to the original memory corruption vulnerabilities the mitigation was designed to prevent.
Researcher Background
Chaotic Eclipse, whose real name is Abdelhamid Naceri, is a security researcher known for publicly releasing proof-of-concept exploits for zero-day vulnerabilities. Naceri previously worked with Microsoft in the UK and Germany before his employment was terminated, which he disputes. He has released multiple zero-day exploits targeting Microsoft products and other security solutions, including Undefend, RedSun Defender, BigDiskBuster, GreenSection, ShieldCrash, HardBreacher, PrettyPrague, and FalconFlank.
The researcher's work has fueled debate over responsible disclosure and the risks of publishing working exploits. Microsoft has not yet commented on the SignDrop vulnerability or announced a timeline for a patch, leaving users vulnerable until a solution is released.
Related
