Windows 0-day dropped by disgruntled researcher hands hackers System rights - Ars Technica
A researcher known as Nightmare Eclipse has disclosed a Windows zero-day vulnerability called SignDrop that grants local users full System rights on certain Windows versions.
Nightmare Eclipse, a researcher with a public dispute with Microsoft, revealed SignDrop, a zero-day vulnerability affecting the Common Log File System (CLFS). This flaw allows local users with standard privileges to gain complete System rights on some Windows versions. The vulnerability stems from a security feature Microsoft implemented in October 2025 to protect against other CLFS exploits.
Exploit Mechanism
The attack exploits the interaction between CLFS, Windows Defender, and Windows file permissions. Attackers manipulate Windows Object Manager symbolic links to force Defender to open a specially crafted CLFS container using the antimalware engine's System privileges. When an authentication file is missing, CLFS creates it with elevated permissions.
Defense Turned Against Itself
The vulnerability emerges from a security measure Microsoft introduced to prevent other CLFS exploits. By using the ServerMpUpdateEngineSignature function, attackers can make Defender process a malicious log file. The newly created file inherits the Discretionary Access Control List from the original file, potentially granting attackers access to System-privileged files.
Related
