SignDrop zero-day lets local users reach System on some Windows builds

On Tuesday, a researcher using the name Nightmare Eclipse—someone with a long-running, highly public dispute with Microsoft—published another Windows zero-day, SignDrop. On some Windows versions it lets a person who is already logged on locally obtain full System rights.

The flaw sits in the Common Log File System. Microsoft calls that component a general logging service for client software, whether the client runs in user mode or in the kernel. SignDrop turns on how that system, Windows Defender, and Windows file permissions work together. Someone who begins with ordinary user rights can push a privileged process, with Defender given as the example, into opening a specially made CLFS container, then misuse the privileged file creation that follows to climb to System. In the exploit, Defender opens a log that a standard user created. The call goes through ServerMpUpdateEngineSignature, an authentic Defender function meant for handling antivirus signature updates.

Will Dormann said in an interview that he reproduced the exploit and that it performs as described, though not across every Windows 11 version. He said the conditions matter: it seems to need Windows 26H2 that has already been around for more than 90 days, and a brand-new 26H2 installation does not become vulnerable merely by receiving updates. He said a machine is exposed only when HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode equals 0 or 1. Of the many computers he uses, only one satisfied that condition.

Microsoft said it was investigating, that it had no evidence the bug was being exploited in the wild, and that Defender blocks potential exploitation attempts.