Security researcher Abdelhamid Naceri, known as Nightmare Eclipse, released a zero-day exploit called SignDrop that lets a local user elevate to System on Windows by abusing flawed logic in the Windows Common Log File System (CLFS). The exploit targets how clfs.sys creates the authentication file ‘.cnpf’ during log file creation, forcing CLFS to sign an empty container and allowing a standard user to coerce Windows Defender into opening a log file via the signature update RPC interface. This causes Defender to create a signature file with System privileges, which the PoC then reopens to inject a payload and spawn a System shell. SignDrop has been tested on Windows 11 26H2, Windows 11 26H2 Experimental, and Windows Server 2025 Experimental, and Naceri says it should work on 80% of Windows installations, with systems older than 90 days generally vulnerable. Cyderes compiled and tested the PoC but found no evidence of wild exploitation. 1