SignDrop Windows CLFS Zero-Day Details and Proof-of-Concept Exploit Published
Do Son 
TL;DR
A researcher using the handle MSNightmare published full details and a working proof-of-concept exploit for SignDrop on November 10, 2026. This unpatched Windows CLFS zero-day lets a standard user gain SYSTEM privileges. It abuses the very CLFS authentication mitigation that Microsoft added to block earlier attacks.
SignDrop turns Microsoft’s CLFS log-file signing feature into a local privilege escalation path. Exploit source code is now public on GitHub, and no patch exists yet. Defenders should watch for abuse until Microsoft responds.
Why It Matters
The public SignDrop proof-of-concept exploit on GitHub includes C++ source and a Visual Studio project. According to the researcher, a working attack “spawns a SYSTEM shell.” The researcher tested it on Windows 11 26H2 and on experimental builds of Windows 11 and Windows Server 2025.
The researcher also makes a broad claim. They “estimate 80% of the world’s windows installations are vulnerable,” but they offer no data behind that figure. Even so, the bug has a second, more worrying use. The write-up says it “can be used to turn off any antivirus/EDR.”
No CVE has been assigned yet, and no attacks in the wild have been reported. Microsoft has not commented publicly.
How the Attack Works
A mitigation turned against itself
Microsoft added HMAC authentication codes to CLFS log files to stop memory corruption attacks. Its blog notes that 19 of 24 CLFS CVEs in five years involved improper validation of log data. During a 90-day “learning” period, CLFS signs log files as they open. After that, it enforces the codes.
Where it breaks
SignDrop targets how clfs.sys creates the “.cnpf” authentication file. When a log has an empty linked container, CLFS signs it whether or not a signature file already exists. The researcher found a way to make a privileged process, such as Microsoft Defender, open a log that a normal user prepared. As a result, CLFS creates the signature file as SYSTEM. Worse, the file inherits the original file’s permissions. As the researcher puts it, “Everything is done properly by Microsoft here but the logic allows abuse.”
Affected Versions
According to the README, systems with CLFS authentication in learning or enforcement mode are vulnerable. That covers registry Mode values 0 and 1 under HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication. Systems older than 90 days are typically in enforcement mode.
Patch and Mitigation
No fix exists for this Windows CLFS zero-day. Turning the mitigation off is not a good answer either. The researcher warns it would expose machines to older CLFS memory corruption bugs. For now, limit local access, monitor for unusual SYSTEM processes, and watch for unexpected .cnpf file creation. Apply Microsoft’s patch as soon as it ships.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
