New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access
C The Hacker News ·
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key insight
A public PoC demonstrates an unpatched, CVE-less CLFS flaw that lets a standard user gain SYSTEM rights; the novelty is the abuse of companion-file creation via object manager symbolic links, and no active attacks have been reported so far.
Description
The proof of concept "SignDrop" targets the clfs.sys driver in the Windows Common Log File System and was published as a local privilege escalation. A standard user prepares a CLFS log and container with paths the user controls; when a privileged process later opens that log, the driver creates the companion file (.cnpf) in the privileged process's security context. Object manager symbolic links redirect that file creation to an attacker-chosen location, making SYSTEM rights reachable. Microsoft has neither confirmed the flaw nor assigned a CVE ID or released a fix; no corresponding patch appears in the November security updates. CLFS has been a frequent privilege-escalation target for years, with ten CLFS flaws now in CISA's KEV catalog, including one used in ransomware campaigns in April 2025. There are no indications of exploitation in the wild for SignDrop; the exploit code and a technical writeup were published on GitHub on November's Patch Tuesday.
Risk score
- cvss base
- 0.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 15.00
- raw before weight
- 15.00
- industry weight
- 1.21
- freshness factor
- 1.00
- exploitability factor
- 1.00
- days old
- 0.00
- vendor mismatch penalty
- 0.00
- consensus penalty
- -3.00
Path: operational
Consensus check
The pipeline self-checks before delivery. These rules lowered the score:
-
TTP_SKIPPEDTTP mapping skipped (placeholder or aggregation article) −3
- Consensus penalty:
- −3.0
- Total penalty:
- −3.0