SignDrop zero-day can grant SYSTEM privileges on Windows

The SignDrop zero-day can give an attacker with access to a vulnerable Windows machine the privileges of the operating system’s own SYSTEM account. Security researcher Abdelhamid Naceri publicly disclosed the flaw and released a proof of concept that he tested on Windows 11 and Windows Server.

Naceri traced the flaw to a change Microsoft made in October 2025 to protect the Common Log File System (CLFS), a Windows component that manages logs. According to Naceri, attacks targeting CLFS flaws dropped sharply after Microsoft introduced authentication for log files. However, he found that the new safeguard also created a way for attackers to gain privileges on some machines.

How the SignDrop zero-day affects Windows security

Windows checks a user’s permissions when that user creates a log. Naceri found that the initial check works as intended. The problem arises later, when Windows handles an authentication file associated with the log. At that point, an operation that began under an ordinary user account can inherit the authority of a more privileged process.

The potential impact extends to security software. Antivirus and endpoint detection tools use tamper protection to keep other programs from changing their files or disabling their defenses. According to Naceri, SignDrop can undermine that protection because the security software sees the file operation as a request from one of its own trusted processes.

Which Windows systems did the researcher test?

Naceri tested the SignDrop zero-day on Windows 11 26H2, Windows 11 26H2 Experimental and Windows Server 2025 Experimental. He estimated that roughly 80% of Windows installations could be vulnerable. That figure represents his estimate of the flaw’s reach beyond the three configurations he tested.

As of November 12, Microsoft had not released a patch for SignDrop. Naceri also cautioned against disabling CLFS authentication as a workaround. Turning it off would remove the protection Microsoft introduced against earlier memory corruption flaws in the same driver.

SignDrop follows a series of Windows vulnerabilities Naceri has disclosed since April, including flaws in Microsoft Defender and BitLocker. Microsoft has since patched several of those issues, among them ShieldBreak, RoguePlanet and YellowKey.