Researcher publishes SignDrop Windows privilege escalation PoC

A researcher using the handle MSNightmare published full details and a working proof-of-concept exploit for SignDrop on 10 November 2026. The unpatched Windows CLFS zero-day lets a standard user gain SYSTEM privileges by abusing the CLFS log-file signing mitigation Microsoft added to block memory corruption attacks. The PoC source code is public on GitHub, and no patch exists yet. Defenders are advised to watch for abuse until Microsoft issues a fix.

The attack hinges on how CLFS signs log files during a 90‑day “learning” period and then enforces HMAC authentication codes. SignDrop targets how clfs.sys creates the “.cnpf” authentication file: if a log has an empty linked container, CLFS signs it even if a signature file already exists.

The researcher explains that a privileged process, such as Microsoft Defender, can be prompted to open a log prepared by a normal user, resulting in the signature file being created as SYSTEM and inheriting the original file’s permissions. The write‑up claims the attack can “spawn a SYSTEM shell” and notes testing on Windows 11 26H2 and experimental builds of Windows 11 and Windows Server 2025. The article also asserts a broad vulnerability estimate of 80% of Windows installations, but provides no supporting data. No CVE has been assigned, and Microsoft has not publicly commented.