Clfs - GoKawiil

Researcher publishes unpatched Windows privilege-escalation zero-day called SignDrop

A researcher using the pseudonym Nightmare Eclipse publicly disclosed a new Windows zero-day vulnerability dubbed SignDrop. The flaw lets a standard local user gain full System-level privileges by tricking Windows Defender into creating a privileged file through the Common Log File System, exploiting symbolic link manipulation and inherited file permissions.

arstechnica.com · 2026-11-13

Researcher discloses new Windows zero-day exploiting CLFS authentication mitigation

Security researcher Abdelhamid Naceri has published a zero-day called SignDrop that abuses a Microsoft mitigation introduced in October 2025 to protect against Common Log File System authentication attacks. Naceri says the flaw lies in how CLFS handles creation of its '.cnpf' authentication file, which can be forced open by a privileged process such as Windows Defender, allowing attackers to gain SYSTEM privileges. He also says the technique can bypass tamper-protection defenses in any antimalware engine because the file-creation request appears to originate from the engine's own trusted process.

bleepingcomputer.com · 2026-11-12