SignDrop exploit turns Windows Defender into a privilege-escalation path

Security researcher Chaotic Eclipse has published a proof-of-concept exploit called SignDrop for a Windows local privilege-escalation flaw. The researcher says a standard user can exploit it to gain SYSTEM privileges and bypass security protections. The flaw affects Microsoft’s mitigation for attacks on the Common Log File System (CLFS), which Microsoft began rolling out to public-release systems on 28 October 2025. Chaotic Eclipse estimates that about 80% of Windows installations may be vulnerable, but this is the researcher’s estimate, not a confirmed figure.

The vulnerability is in `clfs.sys`, which creates an authentication file for a new log container. According to Chaotic Eclipse, an attacker can prepare a CLFS file and use symbolic links in the Windows Object Manager to make Windows Defender open it through `ServerMpUpdateEngineSignature`. If the associated file has no signature, CLFS creates one using Defender’s SYSTEM-level privileges.

The researcher says the same technique could target other antimalware engines and interfere with their self-defence or tamper-protection mechanisms. The published proof of concept was tested on Windows 11 26H2, Windows 11 26H2 Experimental and Windows Server 2025 Experimental; the article reports no confirmed exploitation in the wild.

The mitigation uses a 90-day learning period before full protection is enabled. The researcher says the registry key `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode` indicates the state: values 0 or 1 mean vulnerable, while 2 or 3 mean protected. Disabling the mitigation removes the SignDrop attack path but re-exposes systems to the CLFS memory-corruption vulnerabilities it was designed to address. Chaotic Eclipse says there is no workaround without that trade-off and that users must wait for a Microsoft patch.