Researcher drops new Windows zero-day granting System privileges
A researcher using the pseudonym Nightmare Eclipse, who has a public dispute with Microsoft, disclosed a vulnerability called SignDrop on Tuesday. It lets a local user gain full System rights on some Windows versions.
A researcher using the pseudonym Nightmare Eclipse, who has a long-running, public dispute with software company Microsoft, on Tuesday disclosed another unpatched Windows zero-day vulnerability. Named SignDrop, it allows a user with ordinary rights to gain full System rights, the highest level of access, on some versions of Windows.
Where the flaw lies
The vulnerability is in the Common Log File System (CLFS), which Microsoft describes as a general-purpose logging service used by software clients running in user mode or kernel mode.
An attacker can force a privileged process, such as the Windows Defender antivirus, to open a specially crafted CLFS container. By abusing the resulting privileged file creation, a user with standard rights can elevate their privileges to System.
How the attack works
The attack relies on the interaction between CLFS, Windows Defender and Windows file permissions. It uses Defender's legitimate function ServerMpUpdateEngineSignature, which processes antivirus signature updates, to open a log file created by a standard user. By manipulating symbolic links in the Windows Object Manager, the attacker makes Defender open the CLFS container in the security context of the antimalware engine.
If an associated authentication file is missing, CLFS creates it using Defender's System privileges. Because CLFS gives the new file the Discretionary Access Control List (DACL) of the original file, the attacker may gain access to a file created with System privileges. The file-creation operation can then be abused as part of a privilege-escalation attack.
An ironic origin
The flaw stems from a security measure Microsoft introduced in October 2025 to stop attackers from exploiting other CLFS vulnerabilities. Nightmare Eclipse wrote that, if everything is chained correctly, this legitimate mitigation can be turned against itself to allow privilege elevation. According to the researcher, Microsoft did everything properly, but the logic allows abuse.
