A security researcher has published a working proof-of-concept exploit for a previously unknown flaw in Windows, which he calls SignDrop, that lets an attacker with limited access gain SYSTEM privileges, the highest level on the machine. No official patch is available yet.
How the flaw works
SignDrop is in the Common Log File System driver. It abuses protections Microsoft added in October 2025 against attacks on that driver. The weakness lies in how the driver creates an authentication file when a new log file is made. Access checks are correct at the start, but the logic can be abused if a privileged process later opens the log file. Privileged programs such as Windows Defender can be forced to open such files, so the authentication file ends up created with SYSTEM privileges.
According to the researcher, the flaw can be used against the tamper protection of any antimalware engine, which would let attackers switch off antivirus or endpoint detection tools.
Who found it and who is exposed
The exploit was released on GitHub by Abdelhamid Naceri, who also uses the name Nightmare Eclipse and says he is a former Microsoft employee. He tested it on Windows 11 26H2 and on experimental builds of Windows 11 26H2 and Windows Server 2025, and estimates about 80 per cent of Windows installations are vulnerable. That is his own estimate and has not been independently confirmed. A machine is vulnerable if the proof of concept opens a SYSTEM shell, or if a specific registry setting for the log driver's authentication mode is set to 0 or 1.
Microsoft's position
The reports carried no Microsoft response specific to SignDrop. The researcher says the company implemented its mitigation properly but that the logic allows abuse, and that the only option is to wait for a patch, because turning off the mitigation would expose machines to memory-corruption attacks. After earlier disclosures made without private reporting, Microsoft warned of legal action against anyone engaging in malicious activity that harms its customers, which many in the security community saw as a threat to the researcher.
Since April the same researcher has released a string of Windows zero-days affecting Defender, BitLocker and other components. Microsoft has fixed five of them, ShieldBreak, RoguePlanet, YellowKey, GreenPlasma and MiniPlasma, and the others, including SignDrop, remain unpatched. The reports mention no India or Southeast Asia link, but the flaw affects widely used Windows systems.
