- Researcher Abdelhamid Naceri published SignDrop, an unpatched Windows flaw in a safeguard Microsoft added in October 2025. He says it gives an attacker SYSTEM privileges.
- He also claims it can turn off any antivirus or EDR tool. That claim is unconfirmed, and his exposure figure is his own estimate, not a measured count.
- Check the CLFS registry setting and ask your security team how it would notice endpoint protection going quiet.
A safeguard that became the way in
Security fixes add code. New code can have flaws of its own. A researcher says that has happened inside Windows.
Abdelhamid Naceri, who publishes as Nightmare Eclipse, has released an exploit called SignDrop. It is a zero-day, meaning no patch existed when it appeared. In his GitHub write-up he says it gives an ordinary user SYSTEM privileges. That is the highest level of control on a Windows machine. The sources give no CVE identifier for it.
The lesson is that a defence can become a new place to attack. The researcher says the safeguard was built properly. He says the weakness lies in the logic around it.
What happened
The target is the Common Log File System (CLFS). It is a Windows kernel driver that handles log files. Naceri says attackers liked it because it read complex files deep inside the system. A mistake there becomes memory corruption, which attackers can use to gain more privileges.
On October 28, 2025, Microsoft released a mitigation. CLFS now expects log files to carry authentication codes. Naceri says publicly exploited CLFS flaws dropped sharply afterwards. He says the mitigation itself introduced SignDrop.
How the attack works
When CLFS creates a log file, it also creates a companion authentication file ending in ".cnpf". A log can be linked to another log. Naceri says CLFS signs a linked file when it is empty, whether or not a signature file exists.
He says this is safe while one process does everything, because access checks use the caller's own rights. The trouble starts when a different, privileged process opens the log. Opening a log needs no special flags, only the right path.
Naceri says an attacker can trick Windows Defender into opening the attacker's log. The trick uses manipulated symbolic links, which are redirects inside Windows' internal naming system. Defender then opens the linked file. The missing authentication file is created with SYSTEM rights. He adds that CLFS gives the new file the same permissions as the original file.
Naceri also says the same approach works against any antimalware engine. Its own drivers see a file request from their own trusted process. In his words, it can "turn off any antivirus/EDR." That claim comes from one researcher. The sources do not say anyone else has confirmed it.
How many machines, and how to check
Naceri puts the share of exposed Windows installations at about four in five. That is his estimate, not a measured count. He says he tested the exploit on preview and server builds, including Windows 11 26H2 and Windows Server 2025 builds labelled Experimental.
The CLFS adoption period lasts 90 days from first start. After that, the driver moves into enforcement mode on its next start. Naceri says installations older than 90 days are generally vulnerable.
He also points to a setting in the Windows registry, under the CLFS Authentication key, called Mode. He says a value of 0 or 1 means vulnerable. A value of 2 or 3 means not vulnerable.
BleepingComputer maps the values 0 and 1 to learning mode and enforcement mode. It reports both as vulnerable. Naceri's own text says the same. The sources do not say what values 2 and 3 stand for. They also do not explain why enforcement mode is listed as vulnerable.
Why there is no easy workaround
Naceri says turning the mitigation off exposes machines to the memory corruption flaws it was built to stop. He says the only remedy for now is a patch from Microsoft. The sources mention no patch and no Microsoft response.
BleepingComputer adds context. Naceri says he is a former Microsoft employee. He has disclosed many Windows flaws since April, including in Defender and BitLocker. It reports that Microsoft has fixed some of them. It also says he published without first reporting privately. Microsoft once warned of legal action over "malicious activity causing real harm."
What to ask your team
SignDrop is a local privilege escalation. The sources describe an attacker who already has a foothold as a standard user. It makes a small breach larger. If the researcher's antivirus claim holds, it could also stop endpoint tools from reporting. That remains unconfirmed.
Ask your security lead four questions. Which of our machines show a CLFS Mode value of 0 or 1? Do we get an alert when endpoint protection stops reporting? Who watches for a quiet antivirus failure on a server? Who owns applying Microsoft's fix once it appears?
A control you cannot inspect is a control you are trusting. Defences deserve the same scrutiny as the systems they guard.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Abdelhamid Naceri (Nightmare Eclipse), via his SignDrop GitHub repository.
