Cyderes

Nightmare Eclipse Releases SignDrop Zero-Day Exploit Abusing Windows CLFS for Local Privilege Escalation

Security researcher Abdelhamid Naceri, known as Nightmare Eclipse, has published a zero-day exploit called SignDrop that targets the Windows Common Log File System (CLFS). The exploit enables a local attacker to escalate privileges to SYSTEM by exploiting flawed logic in how clfs.sys handles authentication file creation for .cnpf container files. Microsoft introduced CLFS logfile authentication last year to verify file integrity, yet SignDrop bypasses this mechanism by coercing Windows Defender to open attacker-specified log files during signature updates. The proof-of-concept has been successfully tested on Windows 11 26H2, Windows 11 26H2 Experimental, and Windows Server 2025 Experimental, covering an estimated 80 percent of Windows installations older than 90 days. Cyderes independently compiled and verified the PoC, finding no evidence of in-the-wild exploitation to date. Microsoft has been contacted for comment but has not yet responded.