Vulnerability Details
Security researcher Abdelhamid Naceri, known as "Nightmare Eclipse," has released details of a new zero-day vulnerability targeting Windows systems. The vulnerability is known as SignDrop and allows local users to escalate their privileges to the System level by exploiting a logic flaw in the Common Log File System (CLFS).
The CLFS is a critical Windows component that parses complex log files in Kernel Mode and has been a frequent target for attacks. Although Microsoft introduced authentication mechanisms for log files last year to enhance file integrity, the new vulnerability bypasses this protection by manipulating how authentication files with the .cnpf extension are processed.
How the Exploit Works
The vulnerability relies on the behavior of the CLFS when opening log files; the system attempts to sign the container file even if it is empty. An attacker can create a log file and specify a path associated with a container, then force Windows Defender to open this file within the context of the anti-malware engine via the Remote Procedure Call (RPC) interface.
This process causes Defender to create a signature file with System privileges in a path specified by the attacker. Once the file is created, the attacker can reopen it to inject a malicious payload, ultimately leading to the execution of a shell with full System privileges.
What This Means for Users
According to the researcher, the vulnerability affects a wide range of Windows versions, including Windows 11 26H2 and Windows Server 2025. It is estimated that it could affect approximately 80% of Windows devices worldwide, especially those that have not been updated in the last 90 days.
For its part, Microsoft confirmed that it is investigating the reported vulnerability and is working to take the necessary steps to update affected products. The company stated that Windows Defender is currently capable of detecting and blocking attempts to exploit this vulnerability and alerting on associated privilege escalation behaviors. Reports from the cybersecurity firm Cyderes, which successfully tested the vulnerability, also indicated that there is no evidence yet of this vulnerability being exploited in actual attacks (In the wild).