SignDrop public PoC targets Windows SYSTEM access; no patch yet

Public proof-of-concept code called SignDrop is circulating and claims to turn a Windows CLFS security feature into local elevation to SYSTEM. The latest supplied post reports tests on Windows 11 26H2 and experimental Windows Server 2025 builds, but Microsoft confirmation, a CVE and an official patch are not shown in the evidence.[1]New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Accessthehackernews.com · rssOpen original sourceSee in source list[2]DarkWebInformerx.com · DarkWebInformer · xOpen original sourceSee in source list

The SignDrop repository and accompanying reports describe an attack that starts with an already local Windows user. A prepared log is opened through a privileged process, such as Microsoft Defender, after which the CLFS driver allegedly creates a companion authentication file with SYSTEM privileges. Path redirection is then claimed to convert that privileged file operation into elevation of privilege.[3]github.comgithub.com · rssOpen original sourceSee in source list[1]New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Accessthehackernews.com · rssOpen original sourceSee in source list[2]DarkWebInformerx.com · DarkWebInformer · xOpen original sourceSee in source list

SYSTEM is Windows' highest routine local privilege level, so a successful exploit could let someone who already runs code on a machine take much broader control. Posts also claim the same technique may interfere with antivirus or EDR self-protection, although the supplied evidence does not establish that impact through independent testing.[2]DarkWebInformerx.com · DarkWebInformer · xOpen original sourceSee in source list[4]New Windows SignDrop zero-day grants SYSTEM privileges and bypasses antivirus tamper protectionreddit.com · _cybersecurity_ · r/pwnhub · redditOpen original sourceSee in source list

Until Microsoft provides a determination, defenders should treat this primarily as a local code-execution risk: reduce opportunities for untrusted users or software to run code, and watch for official remediation. Do not disable the CLFS authentication mitigation merely to avoid SignDrop, because the supplied discussion warns that doing so would reopen exposure to earlier memory-corruption attacks.[1]New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Accessthehackernews.com · rssOpen original sourceSee in source list[4]New Windows SignDrop zero-day grants SYSTEM privileges and bypasses antivirus tamper protectionreddit.com · _cybersecurity_ · r/pwnhub · redditOpen original sourceSee in source list

The evidence shows that exploit code and public reporting exist. It does not include a Microsoft advisory, CVE, patch, confirmed exploitation in the wild or an independently verified list of affected releases. Claims about broad exposure and antivirus tamper-protection bypass therefore remain unconfirmed here.[3]github.comgithub.com · rssOpen original sourceSee in source list[5]TheHackersNewsx.com · TheHackersNews · xOpen original sourceSee in source list[4]New Windows SignDrop zero-day grants SYSTEM privileges and bypasses antivirus tamper protectionreddit.com · _cybersecurity_ · r/pwnhub · redditOpen original sourceSee in source list

The Hacker News says the public code claims a local user can gain SYSTEM through CLFS. DarkWebInformer further says the technique was tested on Windows 11 26H2 and experimental Windows Server 2025 variants, with possible antivirus or EDR self-protection impact. These are reported claims, not Microsoft-confirmed findings in the supplied material.[1]New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Accessthehackernews.com · rssOpen original sourceSee in source list[2]DarkWebInformerx.com · DarkWebInformer · xOpen original sourceSee in source list

The reported chain begins with a CLFS log-authentication feature introduced to harden the driver against earlier attacks. SignDrop's central claim is that this defense created a new logic weakness: when a trusted process opens a prepared log, the resulting privileged file creation can allegedly be redirected and repurposed for elevation.[1]New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Accessthehackernews.com · rssOpen original sourceSee in source list[4]New Windows SignDrop zero-day grants SYSTEM privileges and bypasses antivirus tamper protectionreddit.com · _cybersecurity_ · r/pwnhub · redditOpen original sourceSee in source list

4 independent groups, 5 updates, and 10 engagements. Observed communities: r/pwnhub.

At a technical level, the proof of concept targets clfs.sys, the Common Log File System driver. Reports say it prepares a CLFS container, induces a privileged process to open it and exploits how authentication companion files are created. The alleged security boundary failure is not an initial remote entry point, but a privileged file-creation operation available after local execution.[1]New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Accessthehackernews.com · rssOpen original sourceSee in source list[2]DarkWebInformerx.com · DarkWebInformer · xOpen original sourceSee in source list

The strongest supplied evidence is the SignDrop GitHub repository entry and The Hacker News report describing what the public proof of concept claims to do. Social posts and Reddit add affected-version, prevalence and antivirus-impact assertions, but no Microsoft response or independent reproduction is included. Confidence is therefore high that the disclosure and code are public, and lower that every claimed impact or affected version is verified.[3]github.comgithub.com · rssOpen original sourceSee in source list[1]New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Accessthehackernews.com · rssOpen original sourceSee in source list[2]DarkWebInformerx.com · DarkWebInformer · xOpen original sourceSee in source list