A publicly available Windows exploit called SignDrop claims to let a standard local user account gain SYSTEM privileges by abusing the Common Log File System (CLFS) driver. Security researcher Abdelhamid Naceri, who also uses the Nightmare Eclipse and MSNightmare names, published the proof-of-concept on GitHub. Microsoft has not confirmed the reported flaw, assigned it a CVE, or released a patch as of November 12.
The researcher says the issue lies in clfs.sys and the way it creates an authentication file for a new CLFS log. Microsoft’s CLFS documentation says logfile authentication uses hash-based message authentication codes and stores a .cnpf file alongside the log. According to Naceri, a normal user can prepare a log and then trigger a privileged process such as Microsoft Defender to open it, causing CLFS to create the authentication file in the privileged process’s context. The PoC claims this can result in a SYSTEM shell.
BleepingComputer reported that Naceri tested the exploit on Windows 11 26H2, Windows 11 26H2 Experimental and Windows Server 2025 Experimental. Those are the researcher’s reported test systems, not an official list of affected versions. SignDrop is presented as a local privilege-escalation exploit, not a remote attack, and the public disclosure does not establish that attackers are using it in real-world incidents.
Microsoft has not released a fix for SignDrop. Its documentation warns that disabling CLFS logfile authentication causes the driver to parse potentially malicious or corrupted logfiles. CLFS has been targeted by earlier privilege-escalation flaws, including CVE-2023-28252, which Microsoft patched after it was exploited in ransomware attacks. Naceri has also released other Windows exploit code, including the ShieldCrash proof-of-concept.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
