Windows 0-day gives hackers System rights via Defender
Original: Windows 0-day dropped by disgruntled researcher hands hackers System rights
Why This Matters
Unpatched SYSTEM-level exploits with public PoC code raise immediate enterprise risk.
A researcher called Nightmare Eclipse publicly dropped 'SignDrop,' a Windows zero-day that grants local users full System privileges by abusing CLFS and Windows Defender on Windows 11 and Server 2025.
A pseudonymous researcher with a documented grievance against Microsoft has released yet another unpatched Windows exploit. Dubbed 'SignDrop,' the vulnerability chains three components: the Common Log File System (CLFS), Windows Defender, and Windows file permissions.
The attack tricks Defender into opening a crafted CLFS container by calling ServerMpUpdateEngineSignature, a legitimate antivirus signature-update function. When an associated authentication file is missing, CLFS creates it using Defender's System-level privileges — and inherits the original file's DACL. That lets an ordinary local user claim access to a System-privileged file, achieving full privilege escalation.
The irony: SignDrop exploits a security hardening measure Microsoft itself added in October 2025 to block other CLFS attacks. 'Everything is done properly by Microsoft here but the logic allows abuse,' Nightmare Eclipse wrote. The researcher also noted the flaw can be turned against any antimalware engine, potentially disabling AV or EDR products by triggering file creation inside their own process context.
Affected systems include Windows 11 26H2, Windows 11 26H2 Experimental, and Windows Server 2025 Experimental. A proof-of-concept is public. Systems running CLFS in learning or enforcement mode are vulnerable and can be tested by spawning a SYSTEM shell with the supplied PoC.