Nightmare Eclipse, the pseudonym of a researcher with an ongoing, very public beef with Microsoft, has dropped yet another Windows zero-day.
On Tuesday, Nightmare Eclipse disclosed SignDrop, a vulnerability that gives local users full System rights on some versions of Windows. The vulnerability resides in the Common Log File System , which Microsoft describes as a “general-purpose logging service used by software clients running in user-mode or kernel-mode.” By forcing a privileged process such as Windows Defender to open a crafted CLFS container, an attacker with ordinary user rights can abuse the privileged file creation to elevate privileges to System.
The attack exploits the interaction of CLFS, Windows Defender, and Windows file permissions. The exploit uses Windows Defender to open a log file created by a standard user by calling ServerMpUpdateEngineSignature, a legitimate Defender function for processing antivirus signature updates.
By manipulating Windows Object Manager symbolic links, the attacker causes Defender to open the CLFS container in the security context of the antimalware engine. If an associated authentication file is missing, CLFS creates it using Defender’s System privileges. Because CLFS assigns the newly created file the Discretionary Access Control List of the original file, the attacker may gain access to a file created with System privileges, allowing the file-creation operation to be abused as part of a privilege-escalation attack.
Ironically, the vulnerability stems from a security measure Microsoft introduced in October 2025 to prevent attackers from exploiting other vulnerabilities in CLFS.
“If everything is chained correctly, funnily this legit security mitigation can be used against itself and allow an elevation [of] privileges,” Nightmare Eclipse wrote . “Everything is done properly by Microsoft here but the logic allows abuse.”
