GoKawiilResearcher publishes unpatched Windows privilege-escalation zero-day called SignDrop
A researcher using the pseudonym Nightmare Eclipse publicly disclosed a new Windows zero-day vulnerability dubbed SignDrop. The flaw lets a standard local user gain full System-level privileges by tricking Windows Defender into creating a privileged file through the Common Log File System, exploiting symbolic link manipulation and inherited file permissions.
GoKawiil's interpretation of the reporting above, not reported fact.
The flaw reportedly abuses a security mitigation Microsoft added in October 2025 to prevent other CLFS exploits, turning a protective measure into an attack vector, according to the researcher's own description. Because no patch is currently available, organizations may face exposure to local privilege-escalation attacks until Microsoft addresses the issue, and the public disclosure could accelerate exploitation attempts.
- SignDrop lets a low-privileged local Windows user escalate to System-level access.
- The exploit abuses Windows Defender's signature-update function and CLFS container handling.
- The vulnerability reportedly stems from a mitigation Microsoft added in October 2025, which the researcher says can be turned against itself.
Source: arstechnica.com, 2026-11-13
Published there as: “Windows 0-day dropped by disgruntled researcher hands hackers System rights”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.