Researcher reveals SignDrop flaw that abuses Windows log mitigations for SYSTEM access

Security researcher Abdelhamid Naceri, known online as Nightmare Eclipse, has published a zero-day exploit named SignDrop that lets attackers elevate privileges to SYSTEM. The vulnerability targets a security mitigation Microsoft added to the Common Log File System driver in October 2025, which originally aimed to curb authentication attacks against earlier driver bugs. [1][2]

According to Naceri, the flaw stems from how the driver creates .cnpf authentication files. Attackers can coerce privileged processes, including Windows Defender, into opening a new log file, causing the authentication file to generate with SYSTEM privileges under the original file permissions. Naceri claims the method can also bypass tamper protection in any antimalware engine by triggering arbitrary file creation directly inside the legitimate antimalware process context. [1][2]

Naceri tested the exploit on Windows 11 26H2, Windows 11 26H2 Experimental, and Windows Server 2025 Experimental, estimating that 80% of Windows installations are vulnerable. He noted that users must wait for a formal fix from Microsoft because disabling the driver mitigation would re-expose systems to memory corruption attacks. [2]