A researcher called MSNightmare published SignDrop on GitHub on Patch Tuesday. It’s a proof of concept that turns a standard Windows user into SYSTEM through the Common Log File System driver, BleepingComputer and The Hacker News report. Microsoft hasn’t confirmed it, assigned a CVE or shipped a fix.
- It goes after the log-authentication feature Microsoft added to CLFS in October 2025. When a privileged process opens a log the user prepared, the driver creates a companion
.cnpffile in that process’s context. Symbolic links redirect it, so the user ends up with a writable file created as SYSTEM. - In the published chain, the privileged process is Defender’s antimalware service, so Defender has to be on.
- It was tested on Windows 11 26H2 and Server 2025 builds with CLFS authentication enforced or learning. Most established machines are in enforced mode by default.
- 78researchlab confirmed it works but says it isn’t reliable enough for real operations yet.
What to do
Don’t disable CLFS authentication to dodge it. That reopens the older memory-corruption bugs the feature was built to block, and both the researcher and Microsoft’s docs warn against it. Watch for Microsoft’s fix and keep an eye on local privilege escalation alerts in your EDR.
My take
A security feature turned into the attack path, with public code and no patch. That gets the garlic.
God Bless, and Needs Garlic!
