A security researcher known by the pseudonym "Nightmare Eclipse" has disclosed a new zero-day vulnerability in the Windows operating system, which they have named SignDrop. This vulnerability allows local users with limited privileges to escalate their access to the full System level, granting them broad control over the affected device.
How the Vulnerability Works
The vulnerability lies in the Common Log File System (CLFS), a general log service used by Windows applications. The attack exploits the interaction between this service and Windows Defender. The attacker manipulates Windows Object Manager links to force Defender to open a specially crafted CLFS container in an elevated security context. Since the service creates new files with System privileges, the attacker can exploit this process to bypass security restrictions.
Why This News Matters
This vulnerability is particularly significant because it turns a security measure designed by Microsoft in October 2025 to prevent previous attacks into a tool for exploitation. The researcher noted that the vulnerability is unique because it can be used against any antimalware engine to disable its self-defense mechanisms, as the file creation request appears to the engine as if it originated from a legitimate, trusted process.
Scope of Impact and Limitations
The researcher confirmed that the vulnerability affects specific versions such as Windows 11 26H2 and Windows Server 2025 Experimental. For his part, security researcher Will Dormann explained that reproducing the vulnerability is possible, but it requires specific conditions, including that the system must have been running for more than 90 days and that the authentication mode value in the system registry must be set to 0 or 1.
For its part, Microsoft stated that it is investigating the report, confirming that there is no evidence of the vulnerability being exploited in actual attacks to date, and that Windows Defender is working to block potential exploitation attempts.