Windows 0-day dropped by disgruntled researcher hands hackers System rights
Summary
A researcher using the name Nightmare Eclipse disclosed SignDrop, a Windows vulnerability that can let a local user gain System-level privileges on some systems. The exploit uses Windows Defender and the Common Log File System (CLFS) to create a file with elevated privileges; researcher Will Dormann reproduced it on a limited set of Windows installations.Key Facts
- SignDrop exploits the interaction between CLFS, Windows Defender, and Windows file permissions.
- An attacker with ordinary local user rights can make a privileged process open a crafted CLFS container and trigger file creation with System privileges.
- The vulnerability affects some Windows 11 26H2 and Windows Server 2025 Experimental systems, according to Nightmare Eclipse.
- Dormann said the exploit worked on some Windows 11 26H2 systems but not on all versions he tested.
- Dormann said vulnerable systems have the registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode set to 0 or 1.
- Nightmare Eclipse said the vulnerability could be used to interfere with antivirus or endpoint detection software by making its privileged process create files.
- The vulnerability is linked to a CLFS security measure Microsoft introduced in October 2025.
Read the Full Article
This is a fact-based summary from The Actual News. Click below to read the complete story directly from the original source.
