Windows 0-day dropped by disgruntled researcher hands hackers System rights
“SignDrop” exploit lets local users gain all-powerful System rights.
TL;DR
- Nightmare Eclipse has disclosed a new Windows zero-day vulnerability called SignDrop.
- The vulnerability allows local users with ordinary rights to elevate privileges to System level.
- It exploits the Common Log File System (CLFS) by forcing a privileged process like Windows Defender to open a crafted CLFS container.
- The exploit uses Windows Defender's legitimate functions to gain System privileges during file creation.
- This vulnerability can bypass antivirus and EDR self-defense mechanisms.
- It has been confirmed to work on specific versions of Windows 11 and Windows Server 2025 Experimental.
- Vulnerability requires the CLFS authentication mode to be in learning or enforcement mode.
- Microsoft is investigating the vulnerability and states that Defender blocks potential exploitation attempts.