SignDrop

SignDrop Zero-Day Exploit Abuses Windows CLFS Mitigation for SYSTEM Privileges

Security researcher Abdelhamid Naceri has publicly released a new Windows zero-day exploit named SignDrop that grants attackers SYSTEM-level privileges on vulnerable systems. The flaw stems from mitigations Microsoft introduced in October 2025 to address authentication attacks against the Common Log File System (CLFS) driver. Although the mitigation was intended to reduce CLFS-related exploits, its implementation introduced a logic flaw allowing privileged processes such as Windows Defender to be tricked into creating authentication files with SYSTEM permissions. Naceri demonstrated that the technique works against any antimalware engine's tamper protection because file creation requests appear to originate from the engine's own legitimate process. The exploit has been tested successfully on Windows 11 26H2, Windows 11 26H2 Experimental, and Windows Server 2025 Experimental, with an estimated 80 percent of Windows installations remaining vulnerable. No official patch is currently available, and disabling the mitigation would re-expose systems to prior memory corruption attacks in CLFS.