A public Windows exploit called SignDrop targets a security feature meant to stop attacks on the Common Log File System, or CLFS. It claims that a normal user account can be turned into a SYSTEM account, which is the highest level of control on Windows.
The flaw has no CVE number and no patch as of November 11, 2026. Microsoft has also not confirmed the claims.
SignDrop and its public release
A researcher using the handle MSNightmare, also known as Nightmare Eclipse, posted the proof-of-concept on GitHub on November 10, 2026. The researcher has a history of public Windows exploit drops, and Cyber Security News said earlier this year that GitLab suspended the account after GitHub’s earlier ban.
MSNightmare says the bug is in clfs.sys, the kernel driver behind CLFS. The claim centers on how the driver creates a “.cnpf” authentication file when a new log file is made through the exposed \CLFS device. The code uses object manager symbolic links and file timing tricks, and it also claims a high-privilege Windows Defender process can be pushed into creating files in a protected place.
How the CLFS protection works
CLFS has long been a target because it parses complex log files inside the kernel. A small mistake there can become memory corruption, which can lead to higher privileges. To reduce that risk, Microsoft added a hash-based message authentication code, or HMAC, to CLFS log files. The code is built from the file data and a secret key unique to each system.
If the code does not match, CLFS refuses to open the file, as Microsoft’s support page explains. This change reached Windows 11 25H2 and Windows Server 2025 in updates released on or after October 28, 2025.
Windows now starts in a learning mode on new systems. In that mode, CLFS adds authentication codes to old log files as they are opened. Microsoft says that period lasts 90 days from the first start with the updated driver. After that, the driver moves to enforcement mode on its next start.
What the researcher claims
MSNightmare says systems are exposed in either mode, so almost any machine older than 90 days would be vulnerable. The researcher also estimates that about 80 percent of Windows installations are at risk. Daily Security Review says that figure is an estimate, not a measured count.
The claim is limited to a local privilege escalation bug. An attacker must already be able to run code on the machine as a normal user. The exploit cannot break in from the internet by itself.
What reviewers found and did not find
The Rocket Boys review found no CVE, no Microsoft advisory, no independent test, and no sign of use in real attacks. It also did not run the code itself. The same review says the proof-of-concept does not work when CLFS authentication is turned off.
That does not make disabling the feature a good idea. Microsoft Learn says CLFS authentication is on by default, and turning it off lets the driver open and parse any log file, including crafted ones. That would bring back older CLFS attacks the feature was built to stop.
Exposure and response
The researcher reports testing on Windows 11 26H2 and Windows Server 2025 lab setups. For now, the guidance is to keep code execution off important machines, watch for unusual file creation by Defender or other high-privilege processes, and look for unexpected CLFS error codes such as ERROR_LOG_METADATA_CORRUPT.
Admins can review the fsutil clfs command in Microsoft’s documentation before they change any settings. The issue is described as a serious but unconfirmed threat for now, and any fix would probably arrive through a Patch Tuesday update. Until then, Windows updates and tight control over standard accounts remain the stated priority.
Licensed under CC BY-ND 4.0 International