Nightmare Eclipse Says SignDrop Can Give Some Windows Users SYSTEM Access

Nightmare Eclipse's publicly released SignDrop exploit can give a local Windows user SYSTEM-level privileges on some configurations. Researcher Will Dormann reproduced the exploit and said it worked as described, but not on all versions of Windows 11.

Nightmare Eclipse described an attack linking Windows' Common Log File System (CLFS), a logging component, with Windows Defender's signature-update process. The researcher said an attacker can use Windows Object Manager symbolic links to redirect Defender's legitimate ServerMpUpdateEngineSignature function, which processes antivirus signature updates, toward a CLFS container created by a standard user. That causes Defender to open the log in the antimalware engine's security context. If the associated authentication file is missing, CLFS creates it with Defender's elevated privileges while retaining access controls from the original file. Nightmare Eclipse said the user may then gain access to that new authentication file, which is created with SYSTEM privileges.

The exploit involves a CLFS authentication safeguard Microsoft introduced in October 2025 to prevent attackers from exploiting other CLFS vulnerabilities, Nightmare Eclipse said. The researcher reported that SignDrop worked on Windows 11 26H2, Windows 11 26H2 Experimental and Windows Server 2025 Experimental.

Dormann described a limitation involving the Windows 11 build and its age. “The requirements are important in that it seems to require Windows 26H2, and one that has existed for more than 90 days, it seems,” he said. He added that a newly set up Windows 11 26H2 system would not become vulnerable simply by installing updates.

The researchers also described checks for exposure. Nightmare Eclipse said a system is vulnerable when CLFS authentication mode is in learning or enforcement mode. Dormann said the registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode must be 0 or 1; he said only one of the many machines he uses met that registry-value requirement.