Summary
A researcher using the name MSNightmare published a proof-of-concept on GitHub called SignDrop. It claims a local Windows user can gain SYSTEM privileges through the Common Log File System driver (clfs.sys). Microsoft has not confirmed the flaw, assigned a CVE or shipped a fix, and the November 2026 security updates did not address it.
How It Works
SignDrop targets the CLFS log authentication feature that Microsoft added in October 2025 updates for Windows 11 25H2, 26H1 and Windows Server 2025. The feature uses a per-machine HMAC to verify log files the driver wrote.
The exploit abuses how clfs.sys creates a companion .cnpf file when a privileged process opens a prepared log. Object manager symbolic links redirect that file creation. In the published code, the privileged process is the Microsoft Defender antimalware service, triggered through its update interface.
Scope
| Item | Detail |
|---|---|
| Tested on | Windows 11 26H2, a 26H2 Experimental build, Windows Server 2025 Experimental |
| In scope | CLFS authentication mode 0 (enforced) or 1 (learning) |
| CVE | None assigned |
| Patch | None |
| Exploitation in the wild | Not reported; not in CISA KEV |
Established systems typically move to enforcement after 90 days, which is the default the exploit targets.
Independent Testing
Sungyup Nam of 78researchlab reported that Heewon Song of PurpleHound confirmed the exploit works, but judged it not reliable enough for operational use. Defender must be enabled for the chain to work, and running it makes UAC prompts behave conspicuously. Whether it works against other elevated antimalware engines is untested.
What to Do
- Check the mode at
HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication. Modes 0 and 1 fall within the claimed scope. - Do not set mode 2 or 3 to dodge the exploit. They disable the mitigation and reopen CLFS memory corruption risks from tampered logs.
- Watch Microsoft's Security Update Guide for an advisory or patch.
- Hunt for unexpected
.cnpffile creation and symbolic-link activity around Defender update runs.
Source
The Hacker News, reporting on the public GitHub release and third-party verification.