SignDrop Windows CLFS Zero-Day Grants SYSTEM Access
A researcher released SignDrop, a public exploit that claims a standard Windows user can escalate to SYSTEM through the CLFS driver. Microsoft has not confirmed the flaw, assigned a CVE or shipped a fix.
⚡ Why it matters
Local privilege escalation is a key step in ransomware attacks after initial access, and the CLFS driver has been exploited in the wild many times.
A researcher publishing as MSNightmare published a PoC and technical write-up to GitHub on Tuesday, the same day Microsoft shipped its November updates. The exploit targets the Common Log File System (CLFS) driver, Windows' built-in logging subsystem.
Background
In October 2025, Microsoft added an authentication check for CLFS log files in Windows 11 25H2 and 26H1 and Windows Server 2025, to curb the driver's recurring flaws. CISA's KEV catalog lists 10 CLFS bugs, including one used in ransomware attacks in April 2025.
How SignDrop works
The new protection itself becomes the attack surface. A standard user prepares a log with paths they control. When a privileged process opens it, the driver creates a companion .cnpf file with that process's rights. Using object manager symbolic links, the attacker redirects the file creation to a location of their choice and ends up with a SYSTEM-created file they can write to. The PoC uses the Microsoft Defender antimalware service as that privileged process. The researcher says this can be chained into a SYSTEM shell.
Who is affected
The exploit was tested on Windows 11 26H2 and experimental Windows Server 2025 builds. Systems are in scope when the CLFS authentication mode is 0 (enforced) or 1 (learning), which is the default on installs older than 90 days.
What to do
- Check the
Modevalue underHKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication. - Do not disable the protection, since that reopens more serious bugs.
- Monitor unusual calls to the Defender service from standard accounts, and apply Microsoft's fix when it ships.
🔗 Sources
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
Critical CVEs: Synology, SharePoint, VS Code and Routers
Here are the most important critical vulnerabilities published in the US NVD between November 9 and 15, 2026, from Synology and Microsoft to developer tools, WordPress plugins and old home routers, with what to do for each.
Claude 'Office Party' Skills Flaw Runs Code on Linux
AIR Security disclosed Office Party, a flaw in Claude's official Word, PowerPoint and Excel skills that can run malicious code on Linux once a file is planted in a shared temp folder. Anthropic has chosen not to fix it.
Windows Paint Flaw CVE-2026-83844: Update via the Store
Microsoft patched a remote code execution flaw, `CVE-2026-83844`, in Windows Paint after nearly a month of confusion over the fixed version and its Store availability. The safe version is 11.2609.401.0.