Windows zero day gives attackers System privileges through Defender

A Windows zero-day exploit named SignDrop has been disclosed by the pseudonymous researcher Nightmare Eclipse, who is publicly at odds with Microsoft. The bug resides in the Common Log File System (CLFS) and allegedly lets a local user obtain System privileges by forcing a privileged process, such as Windows Defender, to open a crafted CLFS container. By manipulating Windows Object Manager symbolic links, the attacker can cause Defender to open the CLFS container in the antimalware engine’s security context.

If an authentication file is missing, CLFS creates it with Defender’s System privileges. The result is that a file created under System rights can be used to escalate privileges and potentially bypass self-defence protections in antimalware tooling.

The researcher says the vulnerability hinges on the interaction between CLFS, Windows Defender and file permissions, and has demonstrated that the PoC spawns a SYSTEM shell on certain builds. SignDrop is claimed to affect Windows 11 26H2, Windows 11 26H2 Experimental, and Windows Server 2025 Experimental.

Will Dormann has independently reproduced the exploit but notes it does not appear to work on all Windows 11 versions; he says vulnerable systems must meet specific conditions, including a CLFS Authentication Mode value of 0 or 1 in the registry. Dormann indicates the vulnerability may persist only on devices with Windows 26H2 that have existed for more than 90 days. Microsoft did not respond to Ars Technica’s inquiry.