Researcher Discloses New Windows Zero-Day Vulnerability
A smartphone displaying a Windows Defender logo on its screen.
A pseudonymous researcher has disclosed a zero-day vulnerability called SignDrop that permits local users to obtain full System privileges on certain versions of Windows. The exploit forces privileged processes like Windows Defender to open custom log containers, turning a legitimate security mitigation against itself. Microsoft has stated it is currently investigating the disclosure and has no evidence of active exploitation.
- WhenDisclosed on Tuesday
- WhereAffected specific Windows 11 and Windows Server editions
- Who was involvedResearcher Nightmare Eclipse and researcher Will Dormann
- CasualtiesNone
- CauseFlaw involving the Common Log File System and Windows Defender interactions
- StatusUnder investigation by Microsoft
What happened
A researcher operating under the pseudonym Nightmare Eclipse publicly disclosed a fresh zero-day vulnerability affecting Windows. Dubbed SignDrop, the security flaw allows ordinary local users to elevate their privileges all the way up to full System rights on specific versions of the operating system.
The vulnerability is rooted inside the Common Log File System, which serves as a general-purpose logging service for software clients running in either user-mode or kernel-mode. Ironically, the flaw stems directly from a security measure that Microsoft put into place in October 2025 to block older exploits within the same logging system.
An illustration showing a person wearing a hat.
How it unfolded
The exploit forces a privileged process, such as Windows Defender, to open a carefully crafted container created by a standard user. By manipulating Windows Object Manager symbolic links, an attacker tricks Defender into opening the log file within the security context of the antimalware engine by calling a legitimate function for processing antivirus signature updates.
Because an associated authentication file is missing, the logging system creates it utilizing Defender's System privileges while assigning the original file's access control list. This sequence grants the user access to a file created with elevated permissions. Consequently, the flaw can be leveraged to bypass self-defense mechanisms and disable various antivirus or Endpoint Detection and Response tools.
The people involved
The vulnerability was uncovered and published by the pseudonymous researcher Nightmare Eclipse, who has a history of disclosing Windows zero-days. According to the researcher, the exploit targets systems running Windows 11 26H2, Windows 11 26H2 Experimental, and Windows Server 2025 Experimental.
Another researcher, Will Dormann, tested the disclosure and successfully reproduced the exploit. Dormann noted that the vulnerability carries specific prerequisites, requiring an older installation of the 26H2 version that has existed for more than ninety days alongside a specific registry authentication mode value.
Response and aftermath
In response to the public disclosure, Microsoft released a statement indicating that the company is actively investigating the writeup. Software representatives confirmed there is currently no evidence showing the vulnerability is being actively exploited in the wild.
Additionally, Microsoft stated that Windows Defender features built-in blocks designed to stop potential exploitation attempts. Because the operating system receives staged updates, the exact reach of the vulnerability across active user bases remains variable.
What we still don't know
Exact metrics regarding how many individual user systems currently meet the specific time and authentication requirements to be vulnerable have not been fully determined. The full extent of how many machines run the relevant staged Windows versions remains unclear due to Microsoft's rollout methods.