A researcher using the name Nightmare Eclipse has published SignDrop, a proof-of-concept exploit that turns an ordinary Windows user account into the all-powerful System account. It works only on a limited set of machines, and Microsoft has not issued a fix.
SignDrop needs someone to be on the PC already, so it is a second-stage tool: malware that lands with standard rights could use it to take over the machine and, according to the researcher, switch off antivirus protection. A person simply browsing the web is not exposed by it alone.
The bug sits in the Common Log File System (CLFS), the Windows component that programs use to write logs. It stems from a protection Microsoft added to CLFS in October 2025. Microsoft says log files now carry authentication codes, and that a system first spends 90 days in a “learning mode” that adds the codes automatically before it switches to enforcement.
The exploit turns that system against itself. It makes Windows Defender open a log file the attacker created, and when an authentication file is missing, CLFS creates it with Defender’s own System-level permissions. The attacker can then abuse that file to climb to System. The SignDrop page on GitHub adds that other security products could be targeted the same way, which would let an attacker disable them.
The researcher tested it on the 26H2 release of Windows 11, an experimental 26H2 build, and an experimental Windows Server 2025 build. Whether a PC is exposed depends on one registry setting, the CLFS authentication Mode: a value of 0 or 1 means vulnerable, while 2 or 3 does not. The researcher also says there is currently no fix other than waiting for Microsoft’s patch, because disabling the mitigation would expose machines to memory-corruption bugs.
Security researcher Will Dormann, in an interview with Ars Technica, said he reproduced SignDrop and that the exploit does what the researcher claims, though only under certain conditions. In his testing it needs Windows 26H2 and an install more than 90 days old, so a freshly set-up PC with updates does not qualify. Of the many machines he uses, only one met the condition. Microsoft did not respond to a request for comment.
Anyone unsure which release they run can type winver in the Start menu search and compare it with the versions above; the only complete fix is a Microsoft patch, which has no date yet.
