SignDrop, a new Windows zero-day, gives attackers full System rights

SignDrop is a zero-day, which means a flaw that goes public before the company that makes the software has fixed it. Attackers get a head start, because nobody has had time to build a patch.

This one is a privilege escalation bug. That is a flaw that lifts a user from a normal account to something far stronger. Here, the result is System rights, the top level in Windows. A program with System rights can change almost anything on the computer.

The flaw does not break into a PC from the outside. The attacker must already be on the machine with an ordinary account. SignDrop is the step that comes after a first break-in.

In real life Think of a hotel guest who has a room key but gets the master key by tricking the housekeeping cart. The guest was already inside the building. The trick turns one room into every room.

The bug is in the Common Log File System, or CLFS. Microsoft describes it as a general-purpose logging service used by software running in user mode or kernel mode. In plain words, it is a built-in notebook where programs and Windows itself write down what they do.

CLFS has had security problems before. In October 2025 Microsoft added a protection to make it harder to abuse. That protection checks an authentication file that goes with each log.

The researcher says attacks on CLFS dropped sharply after that change. SignDrop shows that the same protection created a new opening.

The attack uses a trusted Windows program as a helper. Here is the sequence, as the researcher describes it:

• Step 1: A normal user creates a log file and points it, using shortcuts called symbolic links, at a place of their choosing.
• Step 2: The attacker makes a privileged program, such as Windows Defender, open that log file. Defender does this through a legitimate function it uses to process antivirus signature updates.
• Step 3: If the matching authentication file is missing, CLFS creates it, and it does so with the System rights of the program that opened the log.
• Step 4: CLFS gives the new file the same access list as the original file. The attacker can then reach a file that was created with System rights.

The catch: Each step looks normal on its own. CLFS checks access correctly at the start. The problem only shows up when a different, more powerful program opens the file later.

The researcher wrote that "everything is done properly by Microsoft here but the logic allows abuse." In other words, nobody made an obvious mistake. The pieces simply fit together in a way no one planned.

Most security programs protect themselves. This is often called tamper protection. It stops other software from changing or switching off the security tool.

The researcher says SignDrop can get around that for any antimalware engine. The reason is that the file request appears to come from the security program's own trusted process. From the point of view of the program's low-level drivers, the request looks legitimate, so it passes.

If that holds up, it would let an attacker turn off an antivirus or an EDR. EDR means endpoint detection and response, the monitoring tools companies run on their computers to spot attacks.

This is the researcher's claim. It has not been tested against every product, so treat it as unconfirmed.

The researcher says SignDrop worked on Windows 11 26H2, Windows 11 26H2 Experimental and Windows Server 2025 Experimental. The estimate is that 80% of Windows installations are vulnerable.

Independent testing paints a narrower picture. Researcher Will Dormann reproduced the attack and said it works as described. But Dormann said the requirements matter: it seems to need Windows 26H2 on a system that has existed for more than 90 days. A new 26H2 install that is fully updated would not work.

Dormann said that out of the many machines in use there, only one met the conditions. Microsoft rolls out Windows updates in stages, so it is not clear how many people have 26H2 at all. You can check your own version by running the "winver" command.

By the numbers:

• 80%: the researcher's estimate of vulnerable installations.
• 1: the number of Dormann's test machines that met the requirements.
• 90 days: the age a 26H2 system seems to need before the attack works.

The gap between those numbers is the honest answer for now. Nobody outside the researcher has measured how many PCs are exposed.

The researcher offers two checks. One is to run the researcher's proof-of-concept program, a small piece of code that shows the flaw works. If it opens a System command window, the machine is vulnerable.

The other is a setting in the registry, the database where Windows keeps its settings. The value is called Authentication\Mode under the CLFS service key. If it is 0 or 1, which stand for learning mode and enforcement mode, the machine is vulnerable.

Neither check is meant for home users. Running unknown exploit code on a real PC is a risk in itself, and editing the registry by mistake can break Windows. IT teams are the people who should look.

For now, no. The researcher says there is no workaround other than waiting for a patch from Microsoft. Turning off the CLFS protection would stop SignDrop, but it would also bring back the memory-corruption attacks the protection was built to block. A memory-corruption bug is a flaw where a program writes data in the wrong place, which attackers can use to take control.

Microsoft representatives did not respond to a request for comment on SignDrop. So there is no official timeline yet.

Microsoft usually ships fixes on Patch Tuesday, the second Tuesday of each month, though it can release urgent fixes at other times.

Nightmare Eclipse is the name used by a researcher who has been publishing Windows zero-days since April 2026. The person says they are a former Microsoft employee. The list includes BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, MiniPlasma, LegacyHive, ShieldCrash, ShieldBreak and several more, many of them aimed at Microsoft Defender and BitLocker, the disk-encryption feature.

Microsoft has fixed some of them, including ShieldBreak, RoguePlanet, YellowKey, GreenPlasma and MiniPlasma. The others still lack an official patch.

The researcher also released several Windows zero-days five years ago. After those releases, Microsoft warned of legal action against anyone engaging in "malicious activity causing real harm" to its customers. Microsoft has also said that disclosures which put exploit code for unpatched flaws into the hands of bad actors are "never justifiable."

The dispute is public and ongoing. The researcher says Microsoft treated them badly, and Microsoft says publishing unfixed flaws puts customers at risk. We have no way to judge the personal claims, and this story is about the flaw.

• Home users: There is nothing to switch off. Install Windows updates as soon as a fix appears, and keep using your security software.
• Use a standard account: Day to day, work from an account without admin rights. SignDrop needs a foothold first, and a smaller foothold means a smaller risk.
• Be careful with downloads: Most first break-ins start with a bad file or a stolen password. Stopping that stops the chain.
• IT teams: Check the CLFS Authentication\Mode value on 26H2 machines and watch for a Microsoft advisory.