Unpatched ‘SignDrop’ Windows Exploit Gives Users Full System Control
A researcher released working code for an unpatched Windows flaw that lets a standard user gain System rights. Microsoft has not issued a fix.
A security researcher has published working attack code for an unpatched flaw in Microsoft Windows that can turn an ordinary user account into one with System privileges, the highest level of control on a Windows machine. The exploit, called SignDrop, was posted to GitHub on Nov. 10 without any coordinated disclosure to Microsoft. As of this week it had no CVE number, the standard ID given to publicly known vulnerabilities, and no patch.
The release comes from a researcher known online as Nightmare Eclipse, who also uses the handles Chaotic Eclipse and MSNightmare. SecurityWeek, a cybersecurity trade publication, identified the person as Abdelhamid Naceri. The same researcher has published a string of Windows exploits this year, beginning with one called BlueHammer in April.
What happened
SignDrop targets the Common Log File System, or CLFS, a part of Windows that apps and system services use to write detailed logs. Attackers have abused CLFS bugs many times, so Microsoft added a defense: log files now carry an authentication code built from the file’s contents and a secret key unique to each machine. CLFS refuses to open a log whose code does not match.
The researcher says the flaw lies in how the CLFS driver creates that signature file, which ends in “.cnpf.” According to SecurityWeek, when a log container is empty, CLFS tries to sign it even if no signature file exists yet. A standard user can set up a log pointing to a location they choose and then use an update interface in Microsoft Defender, the antivirus built into Windows, to get Defender to open it. Because Defender runs with System rights, the signature file is created with those rights in a spot the attacker controls. The attacker can then reopen the file, drop in a payload and open a command shell with System privileges.
Cyber Kendra, a security news site, quoted the researcher as writing that “everything is done properly by Microsoft here but the logic allows abuse.” In other words, the attack chains together features that each work as intended, rather than relying on a memory-corruption bug.
Who is affected
The CLFS protection shipped in updates released on or after Oct. 28, 2025, for Windows 11 version 25H2 and Windows Server 2025, according to Cybersecurity News. New systems run the feature in a 90-day “learning” mode before switching to enforcement. The researcher says machines are exposed in both modes, and SecurityWeek quoted the researcher as saying users are “generally vulnerable if your Windows installation is older than 90 days.”
The researcher said the exploit was tested on Windows 11 26H2 and test builds of Windows Server 2025, and claimed it should work on about 80% of Windows installations. Outlets covering the release stressed that this figure is the researcher’s estimate, not a measured count. Cyber Kendra also noted the researcher’s claim that the technique can disable other antivirus tools, which the site said it could not verify. The attack reportedly also requires Defender to be enabled.
Key points so far:
- SignDrop is a local privilege-escalation bug: an attacker must already be able to run code on the machine as a regular user.
- Cyderes, a security services firm, compiled and tested the proof-of-concept and found it worked, but found no evidence of attacks in the wild, SecurityWeek reported.
- The flaw was not listed in the U.S. Cybersecurity and Infrastructure Security Agency’s catalog of known exploited vulnerabilities as of Nov. 11.
- Microsoft had not publicly confirmed the flaw. SecurityWeek said it had asked the company for comment.
Why it matters
Privilege-escalation flaws rarely make headlines alone, but they are a key step in many real-world break-ins. Criminals who get a foothold through a phishing email or a stolen password often need System rights to turn off security tools, steal credentials or spread ransomware across a network. Publicly available code lowers the bar for doing that.
The release also points to a broader problem: a feature built to block one kind of attack has become the route for another. Cyber Kendra reported that several of the researcher’s earlier unpatched Windows exploits were later abused by attackers in the wild, which is why defenders tend to treat these releases seriously even before Microsoft responds. Cybersecurity News reported that GitLab suspended the researcher’s account after an earlier ban on GitHub.
What comes next
Microsoft did not include a fix in its November security updates, so a patch would most likely arrive in a future monthly release or an out-of-band update. Until then, security outlets warned against the tempting workaround of switching off CLFS authentication. Doing so would let the driver parse any log file, including the kind of crafted files that older CLFS exploits relied on.
Instead, the reports suggest limiting who can run code on important machines, keeping standard accounts tightly controlled, and watching for unexpected .cnpf files being created by Defender or other privileged processes, as well as unusual CLFS error messages. Whether the 80% figure holds up, and how quickly Microsoft responds, will become clearer once the company publishes its own assessment.
