Researcher with public grudge against Microsoft drops Windows zero day granting System rights

A security researcher locked in an ongoing and very public feud with Microsoft has published yet another unpatched Windows vulnerability, one that lets a local user with ordinary privileges seize full System rights on some versions of the operating system.

The researcher, who operates under the pseudonym Nightmare Eclipse, disclosed the flaw on Tuesday and dubbed it SignDrop. The weakness lives in the Common Log File System, a Windows component that Microsoft describes as a "general-purpose logging service used by software clients running in user-mode or kernel-mode."

The attack turns a core Windows defense against the operating system itself. By forcing a privileged process such as Windows Defender to open a specially crafted CLFS container, an attacker with standard user rights can hijack the privileged file creation and use it to climb to System level control.

To pull that off, the exploit relies on the interplay between CLFS, Windows Defender and Windows file permissions. It calls ServerMpUpdateEngineSignature, a legitimate Defender function used to process antivirus signature updates, in order to make the security software open a log file created by a standard user.

By manipulating symbolic links in the Windows Object Manager, the attacker causes Defender to open the CLFS container in the security context of the antimalware engine. When an associated authentication file is missing, CLFS creates it using Defender's System privileges.

Because CLFS assigns the newly created file the Discretionary Access Control List of the original file, the attacker can gain access to a file created with System privileges. That file creation operation can then be abused as part of a privilege escalation attack.

In an ironic twist, the weakness grows out of a security measure Microsoft introduced in October 2025 to stop attackers from exploiting other vulnerabilities in CLFS. The mitigation hardened the component as intended, yet the logic behind it opened a fresh avenue for abuse.

"If everything is chained correctly, funnily this legit security mitigation can be used against itself and allow an elevation [of] privileges," Nightmare Eclipse wrote. "Everything is done properly by Microsoft here but the logic allows abuse."

The disclosure marks the latest in a string of Windows zero days released by Nightmare Eclipse against the backdrop of the researcher's public dispute with the company, adding new pressure on Microsoft over the security of one of the operating system's core logging components.