# Researcher drops Windows zero-day giving hackers System rights

> A disgruntled security researcher has publicly released a Windows vulnerability that lets ordinary users gain full system privileges by exploiting Windows Defender itself.
- Title: Researcher drops Windows zero-day giving hackers System rights
- Summary: A disgruntled security researcher has publicly released a Windows vulnerability that lets ordinary users gain full system privileges by exploiting Windows…
- Keywords: nightmare eclipse, windows zero-day, signdrop vulnerability, common log file system, windows defender, privilege escalation, microsoft, windows 11, windows server 2025, Ars Technica
- Source: Ars Technica — https://arstechnica.com/security/2026/11/windows-0-day-dropped-by-disgruntled-researcher-hands-hackers-system-rights
- Published: 2026-11-13T16:26:32+00:00
- Read time: 1 min
- Topics: nightmare eclipse, windows zero-day, signdrop vulnerability, common log file system, windows defender, privilege escalation, microsoft, windows 11, windows server 2025, technology, science
## Researcher with Microsoft beef drops new zero-day
Nightmare Eclipse, a researcher in a public dispute with Microsoft, has disclosed SignDrop, a Windows vulnerability giving local users full System rights on some versions.
## The vulnerability lives in Windows logging service
SignDrop resides in the Common Log File System, a general-purpose logging service used by software clients running in user-mode or kernel-mode, according to Microsoft.
## Attack turns Windows Defender against itself
The exploit forces Windows Defender to open a crafted CLFS container by calling ServerMpUpdateEngineSignature, a legitimate Defender function for processing antivirus signature updates.
## Security fix from October 2025 enables the attack
The vulnerability stems from a security measure Microsoft introduced in October 2025 to prevent attackers from exploiting other CLFS vulnerabilities. The mitigation itself can be abused.

> If everything is chained correctly, funnily this legit security mitigation can be used against itself and allow an elevation of privileges.
## Exploit works on multiple Windows versions
Nightmare Eclipse said the exploit worked against Windows 11 twenty six H two, Windows 11 twenty six H two Experimental, and Windows Server twenty twenty-five Experimental.
## Vulnerability requires specific system conditions
Researcher Will Dormann reproduced the exploit but found it requires Windows twenty six H two that has existed for more than ninety days. Only one of his many machines met the requirements.

> The requirements are important in that it seems to require Windows 26H2, and one that has existed for more than 90 days, it seems.
## Key takeaway

Nightmare Eclipse disclosed SignDrop, a Windows zero-day that gives local users System rights on some Windows versions by abusing Windows Defender and the Common Log File System.