Vulnerabilities · 15h ago
MSNightmare released SignDrop on Tuesday, a public proof of concept claiming local SYSTEM privilege escalation through Windows’ Common Log File System (CLFS). Microsoft has not confirmed the flaw or issued a fix; 10 CLFS flaws are already in CISA’s catalog of vulnerabilities exploited in attacks.
The PoC says a privileged Windows service opens a log prepared by a regular user, then CLFS creates a companion recovery file as SYSTEM. By redirecting that file into a user-controlled location, the exploit leaves a SYSTEM-owned file the user can modify. That could let someone with a local foothold gain control of the host, through a separate file-creation path that the log-authentication check added in October may not cover.
If valid on the Windows versions in question, the claim means October’s hardening may not close this local privilege-escalation route. Microsoft’s silence leaves both the flaw’s validity and the scope of affected systems unsettled.
2 sources covering this story
New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access
Public SignDrop exploit code abuses Windows CLFS log authentication to enable local SYSTEM privilege escalation, with no Microsoft fix available.
New Windows SignDrop zero-day gives hackers SYSTEM privileges
Security researcher Abdelhamid Naceri (also known as Nightmare Eclipse) has released a new Windows zero-day exploit that can let attackers gain SYSTEM privileges.
Part of the PlainSec briefing for 2026-11-13