New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access

A zero-day privilege escalation exploit named SignDrop targets the Windows Common Log File System (CLFS) driver's log-authentication feature, allowing a local user to gain SYSTEM privileges. The exploit abuses the creation of companion .cnpf files by redirecting their path via symbolic links when a privileged process, such as Windows Defender, opens a prepared log. This results in a SYSTEM-owned file that the attacker can write to, enabling escalation to a full SYSTEM shell. The vulnerability affects systems with CLFS authentication mode set to 0 or 1, and while no official patch or CVE has been issued, the exploit has been publicly demonstrated and independently verified to work, though with reliability issues.

AI-extracted · verify before operational use