SignDrop in the CLFS driver: an exploit that disables any antivirus on Windows

⚡ The gist

• Nightmare Eclipse has published SignDrop — a zero-day in the CLFS driver of Windows that escalates privileges to SYSTEM.
• By his estimate, 80% of Windows installs are affected; you can check via the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode or the PoC.
• There's no patch and no workaround: disabling CLFS protection would simply open the door to the old memory-corruption attacks.

🔍 What happened

Security engineer Abdelhamid Naceri, better known as Nightmare Eclipse or MSNightmare, has publicly released a zero-day exploit called SignDrop. He found it in the Common Log File System (CLFS) driver — the very Windows component that has racked up more exploits than any other in recent years. Naceri himself is a former member of Microsoft's V&M (Vulnerabilities & Mitigation) team at MSRC, so he knows this territory from the inside. He posted the write-up and details publicly, and Habr summarized them in an article.

Here's how it works. When CLFS creates a new log, it also creates an authentication file with the .cnpf extension. The access checks on entry work correctly — the problem is what happens next. If a privileged process later opens the log file, the logic can be turned inside out. Even Windows Defender can be made to open such a file: the authentication file is created with SYSTEM rights, and CLFS applies the rights of the original file. Then things get interesting. The attacker triggers the creation of an arbitrary file in the context of the antivirus process itself, and to kernel drivers the request looks like it came from a legitimate engine. The system lets it through.

Naceri put it this way: "Microsoft implemented everything correctly, but the underlying logic lends itself to abuse." He added that the technique works against any antivirus or EDR. He tested SignDrop on Windows 11 26H2, Windows 11 26H2 Experimental, and Windows Server 2025 Experimental. The check is simple: if the PoC drops you a SYSTEM shell, the machine is vulnerable. The second marker is the Authentication\Mode registry value: 0 or 1 (learning mode or enforcement mode) also indicate vulnerability.

🧠 Our take

There's a beautiful irony here, and it's also the core problem. The measures Microsoft introduced in October 2025 to counter CLFS authentication attacks genuinely reduced the number of attacks on the driver. Our take: this is a case of a defensive mechanism becoming a new attack surface in its own right. Not because it was badly written, but because it changes the rules of the game for everyone who calls into CLFS — and not all of those calls are safe.

What this means in practice comes down to money and trust. An antivirus with its self-protection disabled stops being an antivirus, and an EDR without tamper protection is just a logger. It looks like the enterprise market is in for another round of scrutiny: if the technique really is universal, it hits every security vendor on Windows, not just one. Vendors will have to explain to customers why their "self-protection" rests on the good graces of the CLFS driver.

Who wins? For now, only the researcher himself: his reach and reputation grow with every publication. Who loses — Microsoft, which has no patch, and everyone who treats self-protection as the last line of defense. To the skeptics, we'd note: Naceri already dropped BigDiskBuster against Defender this year, and before that BlueHammer, RedSun, GreenPlasma, YellowKey, UnDefend, and ShieldCrash. This is not some random person with a hypothesis — but it's not official confirmation of a vulnerability either.

⚠️ What we don't know

The big one: no CVE, no response from Microsoft, no independent reproduction. The "80% of Windows installs" figure is the researcher's own estimate — he didn't disclose his methodology in the write-up, so don't take the number at face value. Testing was done on three builds, two of which are flagged as Experimental. It's also unclear what exactly an Authentication\Mode value of 1 signifies: the source calls it a vulnerability marker, though you'd expect enforcement mode to mean the opposite. Test the PoC on an isolated machine, not your daily driver.

Forecast: within the quarter, Microsoft will ship an out-of-band update with a CVE for CLFS and a fix to the .cnpf creation logic. If instead they just change the default mode, the vulnerability will remain — the bar to exploit it will simply get higher.

Disclaimer: not officially confirmed; one source and one researcher.

Source: Habr