Overview
- Security researcher Abdelhamid Naceri published a GitHub proof‑of‑concept this week called SignDrop that claims a local attacker can escalate to SYSTEM by abusing Windows' Common Log File System (CLFS).
- SignDrop forces creation of the CLFS companion signature file (.cnpf) inside a privileged process such as the antimalware service, then uses object manager symbolic links to place that file where the attacker can write to it, which can be chained to a SYSTEM shell.
- The researcher tested the chain on Windows 11 26H2 and Windows Server 2025 Experimental and estimates about 80% of installations are within the claimed scope when the CLFS Authentication registry Mode is 0 or 1.
- Microsoft has not publicly confirmed the issue, assigned a CVE, or released a patch, and experts warn there is no safe workaround because disabling the CLFS mitigation would reopen memory‑corruption risks the feature was meant to block.
- Independent testing by 78researchlab found the PoC can work but is unreliable and noisy, requires Defender to be enabled, and produces visible side effects such as altered UAC behavior, while the technique could let attackers bypass antimalware tamper protections if it is operationalized.