Security researcher Abdelhamid Naceri (Nightmare Eclipse) published an exploit on Thursday for a Windows zero-day called SignDrop. The flaw allows privilege escalation to SYSTEM, meaning full control of the machine, but requires the attacker to already be running code on it.
According to Naceri, the flaw sits in a defense Microsoft added in October 2025 to the CLFS driver (the Windows Common Log File System) to block attacks exploiting bugs in it. He says a privileged process, such as Windows Defender, can be made to open a log file so that the new file is created with SYSTEM privileges. He claims the same technique can bypass the self-protection of antivirus and EDR products.
Naceri tested the exploit on Windows 11 26H2 and on experimental Windows Server 2025, and estimates 80% of Windows installations are vulnerable. He says there is currently no fix other than waiting for a Microsoft patch, because disabling the CLFS mitigation would expose machines to older flaws. The protection mode can be checked in the CLFS registry value Naceri describes, and administrators should watch for a Microsoft update and install it when it ships.
Naceri, who says he is a former Microsoft employee, has disclosed a series of zero-days in Microsoft Defender, BitLocker and other Windows components since April. Microsoft had not commented on SignDrop in the report.