Windows Users Face New Zero-Day Threat as Nightmare Eclipse Releases SignDrop Exploit
A new zero-day exploit has been released into the wild, targeting Windows systems and putting millions of users at risk. Security researcher Abdelhamid Naceri, known online as Nightmare Eclipse, has published a proof-of-concept (PoC) code called SignDrop that can elevate a local user’s privileges to System by abusing a flaw in the Windows Common Log File System (CLFS).
CLFS is a kernel-mode system responsible for parsing complex log files. Last year, Microsoft introduced CLFS logfile authentication to mitigate exploitation, which relies on authentication codes to check file integrity. However, SignDrop exploits a vulnerability in how clfs.sys handles the creation of an authentication file called ‘.cnpf’ during log file creation.
According to Naceri, any standard user can create a log file and specify a path to an associated container, then coerce Windows Defender into opening the file using the signature update RPC interface. This leads Defender to use the file path specified in the container to open the associated log file. If absent, a signature file is created with System privileges.
By abusing this mechanism, SignDrop can create a signature file at an attacker-controlled location and then reopen the file to place a payload in it, resulting in the spawning of a System shell. The exploit has been tested on Windows 11 26H2, Windows 11 26H2 Experimental, and Windows Server 2025 Experimental, and is expected to work on approximately 80% of the world’s Windows installations.
Naceri warns that users are generally vulnerable if their Windows installation is older than 90 days. Although cybersecurity services provider Cyderes has successfully compiled and tested the PoC exploit, there is currently no evidence that SignDrop has been exploited in the wild.
Microsoft has not yet commented on the vulnerability, but it’s clear that this new exploit poses a significant threat to Windows users. As with any zero-day exploit, the best course of action is for users to update their systems immediately and ensure they have the latest security patches installed.
For those who rely heavily on Windows Defender, it may be wise to consider an additional security solution as an extra layer of protection against potential threats like SignDrop. Furthermore, keeping Windows installations up-to-date and patching vulnerabilities promptly can go a long way in mitigating the risk posed by this exploit.
Source: SecurityWeek — 2026-11-13