Public exploit code released earlier this week claims that a local Windows user can gain SYSTEM privileges through the Common Log File System driver.
The proof of concept, called SignDrop, targets a log-authentication feature added to the driver last year. It abuses how clfs.sys creates companion files when a privileged process opens a prepared log, using path redirection to take control of the operation. Microsoft has not confirmed the claimed flaw, assigned a CVE, or released a fix.
The researcher behind the exploit, who publishes under the name MSNightmare, released the code and a detailed writeup on GitHub on Tuesday, the same day the company published its November security updates.
CLFS is a logging subsystem built into Windows. Its driver has been a frequent target for privilege escalation: 10 CLFS flaws appear in CISA’s catalog of vulnerabilities known to have been exploited in attacks, including one used in ransomware campaigns in April 2025.
To reduce that exposure, Microsoft added an authentication check to CLFS log files in updates for Windows 11 25H2, 26H1, and Windows Server 2025 shipped in October 2025. The check attaches a hash-based message authentication code, built from log data and a key unique to each machine.
The driver then parses only log files it wrote. A companion .cnpf file stores recovery data beside each log and is created with the same security attributes as the original, according to the company’s logfile authentication page.
SignDrop targets the creation of that companion file. According to the proof-of-concept code, a standard user prepares a CLFS log and container with paths the user controls. When a privileged process later opens that log, the driver creates the .cnpf file in the privileged process’s security context rather than the user’s.
The exploit uses object manager symbolic links to redirect that file creation to a location the attacker chooses. In the published code, the privileged process is the Defender antimalware service, triggered through its update interface.
“Everything is done properly by Microsoft here but the logic allows abuse,” the researcher wrote.
Because the .cnpf file inherits the original log’s permissions, the result is a file created as SYSTEM that the standard user can write to. The researcher says that can be chained into a SYSTEM shell.
The exploit was tested on Windows 11 26H2, a Windows 11 26H2 Experimental build, and Windows Server 2025 Experimental, according to the repository. Systems are affected when the CLFS authentication registry mode is set to 0 (enforced) or 1 (learning). Systems older than 90 days typically move from learning to enforcement automatically, so the default configuration on established installations is the one the exploit targets.
A registry value of 2 or 3 means the mitigation is disabled. That takes the system outside the claimed attack surface, but the researcher and the driver’s own documentation both warn against it: disabling lets CLFS parse tampered log files, reopening the memory corruption flaws the protection was built to prevent.
Independent Test
Sungyup Nam, head of research at Korean security firm 78researchlab, reported in a published assessment today that researcher Heewon Song of the firm’s PurpleHound offensive content team tested the exploit and found that it works. Song assessed that it does not run reliably enough for operational use, Nam wrote.
Defender must be enabled for the published chain to succeed. Running the exploit changes every UAC prompt to open a standard user shell and a SYSTEM shell, blocking other actions and making the attack noticeable to anyone at the machine.
The repository claims the technique can work against any antimalware engine whose process runs with elevated privileges. That broader claim has not been tested.
What Defenders Can Do
No CVE, advisory, or patch for SignDrop appeared in the November security updates. The CISA Known Exploited Vulnerabilities catalog does not list it, and no attacks using the exploit have been reported.
Administrators can check their exposure by reading the CLFS authentication mode at HKLMSYSTEMCurrentControlSetServicesCLFSAuthentication, where a Mode value of 0 or 1 falls within the researcher’s claimed scope. The vendor’s mitigation guidance describes the setting and the risks of disabling it.
The researcher has released a series of exploits targeting Windows and Defender since April. The vendor confirmed an earlier Defender exploit called RoguePlanet in June as CVE-2026-50656 and patched it the following month.
The ShieldBreak bypass followed in August and was assigned CVE-2026-69414. Three of the researcher’s earlier Defender flaws have been exploited in attacks.
SignDrop is a different class of issue. Where the earlier exploits targeted race conditions in Defender’s file handling, this one targets the CLFS driver’s own authentication feature. The vendor’s security update guide is the place to watch for a response.
