Nightmare Eclipse, the pseudonym of a researcher with an ongoing, very public beef with Microsoft, has dropped yet another Windows zero-day.

On Tuesday, Nightmare Eclipse disclosed SignDrop, a vulnerability that gives local users full System rights on some versions of Windows. The vulnerability resides in the Common Log File System, which Microsoft describes as a “general-purpose logging service used by software clients running in user-mode or kernel-mode.” By forcing a privileged process such as Windows Defender to open a crafted CLFS container, an attacker with ordinary user rights can abuse the privileged file creation to elevate privileges to System.

Turning a Windows defense against itself

The attack exploits the interaction of CLFS, Windows Defender, and Windows file permissions. The exploit uses Windows Defender to open a log file created by a standard user by calling ServerMpUpdateEngineSignature, a legitimate Defender function for processing antivirus signature updates.

By manipulating Windows Object Manager symbolic links, the attacker causes Defender to open the CLFS container in the security context of the antimalware engine. If an associated authentication file is missing, CLFS creates it using Defender’s System privileges. Because CLFS assigns the newly created file the Discretionary Access Control List of the original file, the attacker may gain access to a file created with System privileges, allowing the file-creation operation to be abused as part of a privilege-escalation attack.

Ironically, the vulnerability stems from a security measure Microsoft introduced in October 2025 to prevent attackers from exploiting other vulnerabilities in CLFS.

“If everything is chained correctly, funnily this legit security mitigation can be used against itself and allow an elevation [of] privileges,” Nightmare Eclipse wrote. “Everything is done properly by Microsoft here but the logic allows abuse.”

The researcher continued:

What makes it funnier is the fact that it can be used against any antimalware engine to bypass their self defense (or tamper protection) mechanism as you can trigger arbitrary file creation in the context of their own antimalware process so from the perspective of their kernel drivers, the file creation request is coming from their own legit process so it passes, this makes this vulnerability unique as it can be used to turn off any antivirus/EDR.

Nightmare Eclipse said the exploit worked against Windows 11 26H2, Windows 11 26H2 Experimental, and Windows Server 2025 Experimental. People can see if their systems are vulnerable by checking the CLFS authentication mode. If it’s in learning mode or enforcement mode, the system is vulnerable, and the PoC supplied in the post should spawn a SYSTEM shell. Nightmare Eclipse has published numerous other Windows zero-days in recent months.

Researcher Will Dormann said in an interview that he has been able to reproduce the exploit and that it works as described, but not on all versions of Windows 11. But there’s a catch, he said.

“The requirements are important in that it seems to require Windows 26H2, and one that has existed for more than 90 days, it seems,” he explained. “That is, you can’t just take a new 26H2 system and install updates and have it work.”

For a system to be vulnerable, Dormann said, the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode
value must be 0 or 1.” Out of the many machines Dormann uses, only a single one met this requirement.

Microsoft does staged rollouts of Windows updates, such as 26H2, so it’s not clear how many people have it. You can check by running the “winver” command. Microsoft representatives didn’t respond to an email seeking comment.