Unpatched Windows flaw SignDrop could give local users SYSTEM rights, Microsoft has not responded
Microsoft has not confirmed the issue, assigned a CVE or shipped a fix, and there is no evidence yet of attacks in the wild.
A researcher known as Nightmare Eclipse has published proof-of-concept code for a Windows flaw, dubbed SignDrop, that could let a local user with standard rights obtain SYSTEM privileges. The weakness sits in the Common Log File System driver, where a companion authentication file is created with the privileges of a privileged process such as Windows Defender, and the researcher says the chain can be used against other antimalware engines' tamper protection. Testing covered Windows 11 26H2 and Windows Server 2025 Experimental builds, and the researcher estimates most installations are affected, while an independent group reports the exploit works but is not reliable enough for operational use. Microsoft has not confirmed the issue, assigned a CVE, or released a fix, and administrators can check the CLFS authentication registry mode as a first step while they wait.
Why it matters
For people who run Windows machines, the report means a local account with standard rights may be able to reach the highest level of control on a system, which is a serious risk while no fix exists. The researcher's estimate that about 80% of installations are affected is unverified, and an independent tester found the exploit too unreliable for real attacks, so the practical threat is uncertain. Administrators can read the CLFS authentication mode to gauge their exposure while waiting for Microsoft to act.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.