A newly published proof of concept, the SignDrop zero-day exploit, claims a standard local Windows user can gain SYSTEM privileges through the Common Log File System (CLFS) driver.
Its author, MSNightmare, posted the code and a detailed writeup on GitHub on Tuesday, the same day Microsoft released its November security updates. Microsoft has not confirmed the flaw, assigned a CVE, or issued a fix.
Why Microsoft Added CLFS Authentication
CLFS, Windows’ built-in logging subsystem, has long been a target for privilege escalation. CISA’s Known Exploited Vulnerabilities catalog lists 10 CLFS flaws, including one used in ransomware campaigns in April 2025.
In October 2025, Microsoft added CLFS authentication to Windows 11 25H2, 26H1 and Windows Server 2025. The feature attaches a hash-based message authentication code, built from log data and a key unique to each machine, so the driver parses only logs it wrote.
According to Microsoft’s logfile authentication page, a companion .cnpf file stores recovery data beside each log and is created with the original’s security attributes.
How the SignDrop Zero-Day Exploit Works
SignDrop targets that companion file. A standard user prepares a CLFS log and container using paths they control. When a privileged process later opens the log, clfs.sys creates the .cnpf file in that process’s security context, not the user’s.
Object manager symbolic links then redirect the file creation to a location the attacker chooses. In the published code, the privileged process is the Defender antimalware service, triggered through its update interface.
“Everything is done properly by Microsoft here, but the logic allows abuse,” MSNightmare wrote.
Because the .cnpf file inherits the log’s permissions, the result is a SYSTEM-created file the standard user can write to. The researcher says this can be chained into a SYSTEM shell.
The exploit was tested on Windows 11 26H2, a Windows 11 26H2 Experimental build, and Windows Server 2025 Experimental. Systems are affected when the CLFS authentication mode is 0 (enforced) or 1 (learning).
Machines older than 90 days typically switch to enforcement automatically, so established installations run the targeted default. Values of 2 or 3 disable the mitigation and fall outside the attack surface, but the researcher and the driver’s documentation both warn this lets CLFS parse tampered logs, reopening the memory corruption flaws the feature was built to prevent.
Independent Test of MSNightmare’s Exploit
Sungyup Nam, head of research at Korean security firm 78researchlab, reported today that Heewon Song of its PurpleHound offensive content team found the exploit works, though not reliably enough for operational use.
Defender must be enabled for the chain to succeed. Running it changes every UAC prompt to open a standard user shell and a SYSTEM shell, blocking other actions and making the attack obvious to anyone at the machine.
The repository’s claim that it works against any antimalware engine running with elevated privileges remains untested.
What Defenders Can Do
The November updates contained no CVE, advisory, or patch for SignDrop. CISA’s catalog does not list it, and no attacks have been reported. Administrators can check the Mode value at HKLMSYSTEMCurrentControlSetServicesCLFSAuthentication; a value of 0 or 1 falls within the claimed scope. Microsoft’s mitigation guidance explains the setting and the risks of disabling it.
MSNightmare has released a series of Windows and Defender exploits since April. Microsoft confirmed RoguePlanet as CVE-2026-50656 in June and patched it in July. ShieldBreak followed in August as CVE-2026-69414.
Three of the researcher’s earlier Defender flaws have been exploited in attacks. SignDrop is different: rather than race conditions in Defender’s file handling, it targets the CLFS driver’s own authentication feature. Microsoft’s security update guide is where any response will appear.
