SignDrop targets a separate path to Windows SYSTEM access
MSNightmare released SignDrop on Tuesday, a public proof of concept claiming local SYSTEM privilege escalation through Windows’ Common Log File System (CLFS). Microsoft has not confirmed the flaw or issued a fix; 10 CLFS flaws are already in CISA’s catalog of vulnerabilities exploited in attacks.
The PoC says a privileged Windows service opens a log prepared by a regular user, then CLFS creates a companion recovery file as SYSTEM. By redirecting that file into a user-controlled location, the exploit leaves a SYSTEM-owned file the user can modify. That could let someone with a local foothold gain control of the host, through a separate file-creation path that the log-authentication check added in October may not cover.
If valid on the Windows versions in question, the claim means October’s hardening may not close this local privilege-escalation route. Microsoft’s silence leaves both the flaw’s validity and the scope of affected systems unsettled.
New Windows SignDrop zero-day gives hackers SYSTEM privileges
Security researcher Abdelhamid Naceri (also known as Nightmare Eclipse) has released a new Windows zero-day exploit that can let attackers gain SYSTEM privileges.