Researcher Nightmare Eclipse releases Windows zero-day SignDrop granting System rights
A pseudonymous researcher released SignDrop, a Windows zero-day that lets local users gain System rights by abusing CLFS and Defender. The flaw matters because it turns a security mitigation into a privilege-escalation path and can raise the impact of any ordinary-access foothold.
On Tuesday, a researcher using the pseudonym Nightmare Eclipse disclosed SignDrop, a Windows zero-day that lets an ordinary local user obtain full System privileges. The flaw affects the Common Log File System, a Windows logging service used by user-mode and kernel-mode software. In the published technique, an attacker with standard rights manipulates Defender into opening a crafted CLFS container, then uses the resulting file creation to climb to the highest local privilege level.
The exploit chains CLFS, Defender, and symbolic links. It calls ServerMpUpdateEngineSignature, a legitimate Defender function for antivirus signature updates, to open a log file created by a standard user. By manipulating Windows Object Manager symbolic links, the attacker makes Defender open the CLFS container under the antimalware engine's security context. If an authentication file is missing, CLFS creates it with Defender's System privileges, then inherits the original file's access control list, exposing the new file to the attacker.
The disclosure follows Nightmare Eclipse's ongoing public dispute with Microsoft and is described as another zero-day release. The mechanism is notable because the abuse traces to a Microsoft security measure introduced in October 2025 to block other CLFS vulnerabilities. The researcher wrote that the mitigation is implemented correctly, yet its logic can be chained into privilege escalation. That makes the incident a case study in defensive design: a safeguard can create a new path when combined with privileged components.
For users, the immediate risk is local privilege escalation: an attacker who already has ordinary access to a Windows machine could use SignDrop to gain System rights, the highest level of control. The role of Defender matters because the attack abuses a trusted security component rather than bypassing it. The article identifies affected versions only broadly, and no CVE or patch status is stated in the source, leaving the exact exposure window unresolved.
Anyone with a Windows machine is affected if an attacker first gains ordinary local access, because SignDrop can elevate that access to full System control. The abuse of Defender makes the risk more serious because it weaponizes a trusted security component.
Sources (1)
- [1]Original source(https://arstechnica.com/security/2026/11/windows-0-day-dropped-by-disgruntled-researcher-hands-hackers-system-rights/)