Nightmare Eclipse Releases SignDrop Windows Exploit That Elevates Local Users to SYSTEM
Nightmare Eclipse released SignDrop, a public Windows privilege-escalation proof-of-concept that abuses CLFS and Windows Defender to obtain SYSTEM rights. Cyderes says it compiles and works, while finding no evidence of active exploitation. The release matters because it exposes a local escalation path in widely deployed Windows systems and makes exploitation easier for attackers with local access.
Abdelhamid Naceri, the security researcher known as Nightmare Eclipse, published SignDrop, a proof-of-concept Windows zero-day that lets a local user escalate privileges to SYSTEM by abusing Common Log File System handling of authentication files. The exploit targets clfs.sys logic that creates or opens a container file when a log file is opened, then coerces Windows Defender through a signature-update RPC interface to open an attacker-specified path, ultimately allowing creation of a signature file with SYSTEM privileges.
Cyderes, a cybersecurity services provider, compiled and tested the proof-of-concept and said it works as described, while finding no evidence that SignDrop has been exploited in the wild. Naceri said the exploit was tested on Windows 11 26H2, Windows 11 26H2 Experimental and Windows Server 2025 Experimental, and estimated 80% of Windows installations are vulnerable if older than 90 days. SecurityWeek said it had not independently tested the code and had sought comment from Microsoft.
The technical detail matters because CLFS runs in kernel mode and Microsoft added log-file authentication last year to block abuse. SignDrop does not bypass that protection outright; it manipulates the file-opening sequence so a high-integrity Defender process performs the file creation on the attacker controlled behalf. That turns a defensive component into a privileged file-creation primitive, a pattern seen in local privilege escalation bugs where trusted services are tricked into writing attacker controlled content.
Affected systems are those running the tested Windows variants and, by the researcher estimate, installations older than 90 days. The immediate risk is local privilege escalation: an attacker or malware already on a machine could gain SYSTEM rights, bypass user restrictions and weaken defenses while a patch or mitigation is not described in the report. The public proof-of-concept also raises exposure because exploit development is now easier for anyone who can compile and run the code.
It affects Windows users and enterprises where an attacker already has local access, because the exploit can raise privileges to SYSTEM and weaken defenses. Public proof-of-concept code lowers the barrier for further exploitation.
Sources (1)
- [1]Original source(https://www.securityweek.com/nightmare-eclipse-drops-windows-zero-day-exploit-signdrop/)