Updated

Nightmare Eclipse, a pseudonymous researcher in a public dispute with Microsoft, disclosed a Windows zero-day called SignDrop on Tuesday that gives local users full System rights on some Windows versions, Ars Technica reported. The flaw sits in the Common Log File System (CLFS), which Microsoft describes as a general-purpose logging service. An attacker with ordinary user rights can use Windows Defender's ServerMpUpdateEngineSignature function, a legitimate antivirus signature-update routine, to make Defender open a crafted CLFS container, and symbolic link manipulation lets the attacker abuse the file creation to reach System privileges. The bug stems from a security mitigation Microsoft introduced in October 2025 to protect CLFS. Nightmare Eclipse claimed the exploit works against Windows 11 26H2, Windows 11 26H2 Experimental and Windows Server 2025 Experimental, and said it could be used to disable any antivirus or EDR product. Ars Technica reported that the researcher said systems are vulnerable if the CLFS authentication mode is in learning or enforcement mode. Researcher Will Dormann reproduced the exploit and said it works as described but not on all Windows 11 versions. He said it appears to need a 26H2 system that has existed for more than 90 days, so fresh installs with updates may not be affected, and that only one of his many machines met the required registry setting. Microsoft staged rollouts mean it is unclear how many people run 26H2, and Microsoft did not respond to a request for comment. Users can check their version with the winver command.