From Ars Technica · · 1m 30s
Researcher drops Windows zero-day giving hackers System rights
A disgruntled security researcher has publicly released a Windows vulnerability that lets ordinary users gain full system privileges by exploiting Windows Defender itself.
In brief
A disgruntled security researcher has publicly released a Windows vulnerability that lets ordinary users gain full system privileges by exploiting Windows Defender itself. Nightmare Eclipse disclosed SignDrop, a Windows zero-day that gives local users System rights on some Windows versions by abusing Windows Defender…
Researcher with Microsoft beef drops new zero-day
Nightmare Eclipse, a researcher in a public dispute with Microsoft, has disclosed SignDrop, a Windows vulnerability giving local users full System rights on some versions.
The vulnerability lives in Windows logging service
SignDrop resides in the Common Log File System, a general-purpose logging service used by software clients running in user-mode or kernel-mode, according to Microsoft.
Attack turns Windows Defender against itself
The exploit forces Windows Defender to open a crafted CLFS container by calling ServerMpUpdateEngineSignature, a legitimate Defender function for processing antivirus signature updates.
Security fix from October 2025 enables the attack
The vulnerability stems from a security measure Microsoft introduced in October 2025 to prevent attackers from exploiting other CLFS vulnerabilities. The mitigation itself can be abused.
“If everything is chained correctly, funnily this legit security mitigation can be used against itself and allow an elevation of privileges.”
Exploit works on multiple Windows versions
Nightmare Eclipse said the exploit worked against Windows 11 twenty six H two, Windows 11 twenty six H two Experimental, and Windows Server twenty twenty-five Experimental.
Vulnerability requires specific system conditions
Researcher Will Dormann reproduced the exploit but found it requires Windows twenty six H two that has existed for more than ninety days. Only one of his many machines met the requirements.
“The requirements are important in that it seems to require Windows 26H2, and one that has existed for more than 90 days, it seems.”
What matters most
Nightmare Eclipse disclosed SignDrop, a Windows zero-day that gives local users System rights on some Windows versions by abusing Windows Defender and the Common Log File System.
