Researcher releases SignDrop flaw that can grant Windows users System privileges

Researcher Nightmare Eclipse has published SignDrop, a Windows flaw that can let someone with an ordinary local account gain the highest system privileges. The issue matters because the exploit may also let an attacker interfere with antivirus or endpoint protection software.

SignDrop abuses how Windows Defender handles a crafted Common Log File System container: under certain conditions, Defender creates a file with System privileges that the attacker can access. The researcher says it works on Windows 11 26H2, its experimental version and Windows Server 2025 Experimental. Researcher Will Dormann reproduced it on some systems, but said it appears to require a 26H2 installation that has existed for more than 90 days; affected systems have CLFS authentication mode set to 0 or 1.