Executive Summary
SignDrop is a zero-day local privilege escalation (LPE) exploit that weaponizes Microsoft's own security mitigations in the Common Log FileSystem (CLFS) driver. Released on November 10, 2026, by a researcher known as MSNightmare (part of the Nightmare-Eclipse cluster), the exploit targets a logic flaw in how clfs.sys handles HMAC-based authentication codes (.cnpf files). The vulnerability exists when CLFS authentication is in 'Learning' (Mode 1) or 'Enforcement' (Mode 0) modes, which is the default for most Windows 11 and Server 2025 installations older than 90 days.
The attack chain involves coercing a privileged process—typically Microsoft Defender via its signature update RPC interface—to open a specially crafted CLFS log. The exploit uses Object Manager symbolic links to redirect the creation of the privileged .cnpf signature file to an attacker-controlled path, such as the 'ink' directory. This allows a standard user to overwrite a system DLL (like hid.dll) and achieve code execution as SYSTEM via DLL sideloading during UAC prompt generation.
This threat is significant because it turns a security hardening feature into an attack primitive. Disabling the mitigation is not recommended, as it re-exposes the system to legacy memory corruption vulnerabilities. As of mid-November 2026, there is no official patch, though detection strategies focusing on symbolic link churn and Defender RPC calls from unexpected processes are available.