New Windows Zero-Day Turns Microsoft's Own Defender Into an Attack Tool

Security researchers have uncovered a critical new vulnerability in Windows named "SignDrop" that allows attackers to bypass Microsoft's own security protections. The flaw exploits a staged rollout of a Microsoft security feature designed for the Common Log File System (CLFS), enabling local attackers to escalate privileges to SYSTEM-level access. According to researcher Chaotic Eclipse, approximately 80% of Windows installations worldwide may be vulnerable, particularly systems where the CLFS authentication mitigation is still in its 90-day learning period.

This vulnerability effectively turns Microsoft's defensive measures against itself, creating a situation where the very security system meant to protect users becomes an attack vector. The exploit resides in the clfs.sys driver and can be checked via a specific Windows Registry key. With SYSTEM privileges, attackers could install malware, steal credentials, or completely compromise affected machines, making this a serious threat that demands immediate attention from Windows administrators and users.

What to do: Check the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode registry key and apply Microsoft security updates when available.