New Windows Zero-Day 'SignDrop' Exploits Defender to Hijack Systems

Security researcher Abdelhamid Naceri, known as Nightmare Eclipse, has published a zero-day exploit called 'SignDrop' that targets Windows systems. The exploit abuses a vulnerability in the Windows Common Log File System (CLFS) to trick Windows Defender into creating a system-level signature file at an attacker-controlled location. This allows a local user with standard privileges to escalate their access to full System privileges, effectively taking complete control of the machine.

The exploit has been confirmed to work on Windows 11 26H2 and Windows Server 2025, and the researcher claims it affects roughly 80% of global Windows installations, particularly those older than 90 days. This represents a critical escalation path for attackers who gain initial access to a system, enabling them to bypass security controls and embed persistent malware. Systems remain vulnerable until Microsoft issues an official patch.