Security researcher Abdelhamid Naceri, also known as Nightmare Eclipse, has released a new zero-day vulnerability in the Windows operating system known as SignDrop, which allows attackers to gain full SYSTEM privileges by exploiting a protection mechanism added by Microsoft in October 2025 to counter authentication attacks targeting the Common Log File System (CLFS) driver.
The researcher explained that the vulnerability lies in the way the CLFS driver handles the creation of the authentication file with the .cnpf suffix when creating a new log file. While the system correctly performs access permission checks initially, the logic can be abused if another privileged process opens the log file later, causing privileged processes such as Windows Defender to open the files and generate the authentication file with SYSTEM privileges.
How does the vulnerability bypass protection mechanisms?
The SignDrop vulnerability is uniquely capable of working against the self-protection mechanisms of any anti-malware engine or Endpoint Detection and Response (EDR) systems. This is because the file creation request appears to originate from the engine's own legitimate process from the perspective of kernel-mode programs, allowing it to bypass protection and disable any antivirus software.
Naceri noted that he tested the exploit on Windows 11 26H2 and Windows Server 2025 preview systems, estimating that about 80% of Windows installations could be at risk. As of now, there are no solutions available other than waiting for an official security patch from Microsoft, as disabling CLFS protection hooks could expose devices to other security risks related to memory corruption.
What does this mean for users and administrators?
This vulnerability highlights the complexity of software interactions between security fixes and core operating system components. Until Microsoft releases an official security update, system administrators have no choice but to monitor security alerts and wait for official patches, with the possibility of using proactive scanning tools provided by the researcher to verify the extent of the impact on current systems without an immediate way to stop the risk entirely.