Unpatched Windows Zero-Day 'SignDrop' Hands Attackers SYSTEM Rights

A working exploit for an unpatched Windows privilege-escalation flaw is now public, and its author estimates it exposes roughly 80% of Windows installations. Abdelhamid Naceri, a researcher who goes by Nightmare Eclipse and says he is a former Microsoft employee, published the proof of concept and named the bug SignDrop. Anyone who runs it and gets a SYSTEM shell has confirmed exposure the hard way.

The flaw sits in the Common Log File System (CLFS) driver, and it subverts a mitigation Microsoft shipped in October 2025. According to Naceri, the access checks hold up correctly when CLFS creates a ".cnpf" authentication file for a new log. The weak point comes later. When a privileged process such as Windows Defender opens that log, the abuse becomes possible.

That timing matters for the antivirus crowd. Because the file request then appears to originate from a security engine's own process, Naceri says the same technique can switch off the tamper protection of antivirus and EDR products. A bug that starts as a privilege escalation ends as a defense disarmament tool.

How bad is it, and who's exposed?

Naceri tested SignDrop on Windows 11 26H2, an experimental Windows 11 26H2 build and an experimental Windows Server 2025 build. Based on that work, he puts the exposed share of Windows installations at about 80%. His estimate, not Microsoft's — the company had not commented on SignDrop at the time of reporting.

Admins can check two things without waiting:

• Run the proof of concept. If it opens a SYSTEM shell, the machine is vulnerable.
• Read the registry value at HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode. A value of 0 or 1 means vulnerable, per Naceri.

There is no patch. Naceri also rules out the obvious workaround: disabling the CLFS mitigation would expose machines to memory-corruption attacks, he says, so users simply have to wait for Microsoft. BleepingComputer reported no in-the-wild exploitation of SignDrop so far.

Why is this researcher dropping zero-days in public?

SignDrop is the latest entry in a busy year. Since April, Naceri has released zero-days that Microsoft later patched, including ShieldBreak, RoguePlanet and YellowKey. Six more remain unfixed, among them BlueHammer, RedSun and UnDefend, according to BleepingComputer.

The relationship has soured. After Naceri began publishing flaws without private disclosure, Microsoft warned it could take legal action against anyone engaged in "malicious activity causing real harm" to its customers. Many security researchers read that statement as a threat aimed at disclosure itself.

The timing is awkward for Redmond. Microsoft's November Patch Tuesday, released two days before the SignDrop drop, fixed 1,093 flaws — one of the year's largest batches — yet left this one out entirely.

With no patch, no practical workaround and a working exploit in the open, defenders' near-term options narrow to monitoring the CLFS registry key and watching for Microsoft's next cumulative update.