Security researcher Abdelhamid Naceri, who publishes as MSNightmare or Nightmare Eclipse, released public proof-of-concept code on GitHub on Tuesday for a Windows privilege-escalation exploit named SignDrop.

The PoC claims a standard local user can gain SYSTEM privileges through the Common Log File System (clfs.sys) driver. According to The Hacker News, Microsoft has not confirmed the flaw, assigned a CVE, or shipped a fix, and the November security updates contained nothing for it.

BleepingComputer reports the researcher says the only current solution is waiting for Microsoft, because disabling the CLFS mitigation would reopen devices to memory-corruption attacks the feature was built to stop.

SignDrop is striking because it weaponizes a defense rather than bypassing it. In October 2025, Microsoft added a log-authentication check to CLFS in Windows 11 25H2, 26H1, and Windows Server 2025, attaching a hash-based message authentication code so the driver parses only logs it wrote.

Naceri found the flaw in how CLFS creates the companion ".cnpf" authentication file: access checks pass initially, but the logic can be abused when a different, privileged process later opens the log.

"Everything is done properly by Microsoft here but the logic allows abuse," the researcher wrote — the mitigation can, chained correctly, be used against itself for elevation of privilege.

The PoC has a standard user prepare a CLFS log with attacker-controlled paths, then wait for a privileged process to open it.

When that happens, the driver creates the .cnpf file in the privileged process's security context, and the exploit uses object manager symbolic links to redirect that file creation to a location of the attacker's choosing.

In the published chain, the privileged process is the Windows Defender antimalware service, triggered through its update interface.

Because .cnpf inherits the original log's permissions, the user ends up with a SYSTEM-owned file they can write to, which the researcher says chains into a SYSTEM shell.

Naceri claims the technique works against any antimalware engine's self-defense, because file-creation requests appear to come from the engine's own legitimate process, allowing attackers to switch off any antivirus or EDR. That broader claim has not been independently tested.

BleepingComputer reports he estimates 80% of Windows installations are vulnerable, based on his testing on Windows 11 26H2, Windows 11 26H2 Experimental, and Windows Server 2025 Experimental.

The Hacker News adds independent corroboration: researcher Heewon Song of Korean firm 78researchlab's PurpleHound team tested the exploit and confirmed it works, though assessed it is not reliable enough for operational use and is conspicuous, hijacking UAC prompts visibly.

Administrators can check exposure via the registry at HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication: a Mode value of 0 (learning) or 1 (enforcement) falls within the claimed attack surface, while 2 or 3 means the mitigation is disabled — which the researcher and Microsoft's documentation both warn against, since it reopens tampered-log parsing.

Running the PoC is another check: a spawned SYSTEM shell means the machine is vulnerable. No attacks using SignDrop have been reported, and it is absent from CISA's Known Exploited Vulnerabilities catalog.

CLFS is a proven escalation target — The Hacker News notes ten CLFS flaws appear in CISA's catalog, including one used in ransomware campaigns in April 2025.