A security researcher has published a new, unpatched Windows vulnerability called SignDrop. It lets someone who already has an ordinary user account on a PC give themselves System rights, the highest level of control in Windows. The good news: it only works on some Windows 11 26H2 machines, it can’t be used remotely on its own, and Microsoft says Windows Defender blocks attempts to exploit it. Here’s what you need to know and how to check your PC.
What SignDrop does
SignDrop was disclosed on Tuesday by Nightmare Eclipse, the pseudonym of a researcher who has been in a long public dispute with Microsoft and has released several other Windows zero-days in recent months. A zero-day is a flaw made public before the software maker has a fix.
According to Ars Technica, the bug sits in the Common Log File System (CLFS), a logging service built into Windows. By tricking a privileged process, Windows Defender, into opening a specially crafted log file, an attacker with a normal account can make Windows create a file with System privileges that the attacker can then control. Ironically, the weakness comes from a protection Microsoft added to CLFS in October 2025 to block other attacks.
This is what security people call a privilege escalation flaw. It doesn’t let a stranger break into your PC over the internet by itself, but malware or an attacker who already got a foothold, for example through a malicious download, could use it to take full control of the machine.
Which PCs are affected
Nightmare Eclipse said the exploit works on Windows 11 26H2, including the Experimental builds, and on Windows Server 2025 Experimental. Security researcher Will Dormann told Ars Technica he reproduced it and that it works as described, but not on every Windows 11 PC.
The key requirement is a CLFS setting. Dormann said a PC is only vulnerable if the CLFS authentication mode in the registry is set to 0 or 1 (learning mode or enforcement mode), and that this seems to apply to 26H2 systems that have been running for more than 90 days, not fresh installs. Of the many machines Dormann uses, only one met that requirement. Because Microsoft rolls out Windows versions in stages, it’s not clear how many people are exposed.
How to check your Windows version
- Press Windows + R, type winver and press Enter.
- The window that opens shows your Windows 11 version. If it doesn’t say 26H2, this flaw doesn’t apply to you.
Our guide on how to check your Windows 11 version and update it walks through this with more detail.
What Microsoft says
In a statement to Ars Technica, Microsoft said it is investigating the write-up and has no evidence the vulnerability is being exploited in the wild. The company also said Windows Defender blocks potential exploitation attempts. There’s no patch yet, so a fix would most likely arrive in a future Windows update.
How to stay safe until there’s a fix
- Keep Windows Defender (Microsoft Defender Antivirus) turned on and updated. Microsoft says it blocks this attack.
- Install Windows updates as soon as they arrive. A patch for SignDrop will come through Windows Update.
- Use a standard account for daily use and don’t share admin access with people who don’t need it.
- Be careful with downloads. Because this flaw needs an attacker to already be on your PC, avoiding shady files and fake pop-ups is your first line of defense. See our guide on how to stop fake virus pop-ups on Windows.
Security flaws in popular software keep coming: last month we covered a Plex Media Server vulnerability that was actively exploited. We’ll update this story when Microsoft releases a fix for SignDrop.
Source: Ars Technica
