New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access
Public exploit code released earlier this week claims that a local Windows user can gain SYSTEM privileges through the Common Log File System driver.
Public exploit code released earlier this week claims that a local Windows user can gain SYSTEM privileges through the Common Log File System driver.
The proof of concept, called SignDrop, targets a log-authentication feature added to the driver last year.
It abuses how clfs.sys creates companion files when a privileged process opens a prepared log, using path redirection to take control of the operation.
Microsoft has not confirmed the claimed flaw, assigned a CVE, or released a fix.
The researcher behind the exploit, who publishes under the name MSNightmare, released the code and a detailed writeup on GitHub on Tuesday, the same day the company published its November security updates.
To reduce that exposure, Microsoft added an authentication check to CLFS log files in updates for Windows 11 25H2, 26H1, and Windows Server 2025 shipped in October 2025.
According to the proof-of-concept code, a standard user prepares a CLFS log and container with paths the user controls.
Its driver has been a frequent target for privilege escalation: 10 CLFS flaws appear in CISA's catalog of vulnerabilities known to have been exploited in attacks, including one used in ransomware campaigns in April 2025.
When a privileged process later opens that log, the driver creates the .cnpf file in the privileged process's security context rather than the user's.
The check attaches a hash-based message authentication code, built from log data and a key unique to each machine.
A companion .cnpf file stores recovery data beside each log and is created with the same security attributes as the original, according to the company's logfile authentication page.
The exploit uses object manager symbolic links to redirect that file creation to a location the attacker chooses.
In the published code, the privileged process is the Defender antimalware service, triggered through its update interface; a registry value of 2 or 3 means the mitigation is disabled.
Running the exploit changes every UAC prompt to open a standard user shell and a SYSTEM shell, blocking other actions and making the attack noticeable to anyone at the machine.
What happened
Public exploit code released earlier this week claims that a local Windows user can gain SYSTEM privileges through the Common Log File System driver.
The proof of concept, called SignDrop, targets a log-authentication feature added to the driver last year.
It abuses how clfs.sys creates companion files when a privileged process opens a prepared log, using path redirection to take control of the operation.
What changed
Microsoft has not confirmed the claimed flaw, assigned a CVE, or released a fix.
The researcher behind the exploit, who publishes under the name MSNightmare, released the code and a detailed writeup on GitHub on Tuesday, the same day the company published its November security updates.
Who is affected
To reduce that exposure, Microsoft added an authentication check to CLFS log files in updates for Windows 11 25H2, 26H1, and Windows Server 2025 shipped in October 2025.
According to the proof-of-concept code, a standard user prepares a CLFS log and container with paths the user controls.
Why it matters
Its driver has been a frequent target for privilege escalation: 10 CLFS flaws appear in CISA's catalog of vulnerabilities known to have been exploited in attacks, including one used in ransomware campaigns in April 2025.
When a privileged process later opens that log, the driver creates the .cnpf file in the privileged process's security context rather than the user's.
Technical details
The check attaches a hash-based message authentication code, built from log data and a key unique to each machine.
A companion .cnpf file stores recovery data beside each log and is created with the same security attributes as the original, according to the company's logfile authentication page.
The exploit uses object manager symbolic links to redirect that file creation to a location the attacker chooses.
Response
In the published code, the privileged process is the Defender antimalware service, triggered through its update interface; a registry value of 2 or 3 means the mitigation is disabled.
What security teams should do
No CVE, advisory, or patch for SignDrop appeared in the November security updates.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.