thehackernews.com • 7h
SignDrop Zero-Day Exploit Targets Microsoft Windows clfs.sys for SYSTEM Privilege Escalation
SignDrop is a locally exploitable Windows zero-day in the Common Log File System driver (clfs.sys) that permits standard local users to escalate privileges to SYSTEM. The exploit abuses the CLFS log-authentication and mitigation feature by forcing a privileged process, such as Windows Defender, to open a crafted container, triggering privileged companion file creation through path redirection. Successful exploitation requires Windows 11 26H2 with system age exceeding 90 days and the registry value HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode set to 0 or 1. Microsoft is investigating, reports no confirmed in-the-wild exploitation, and states Windows Defender blocks attempts.
Links:thehackernews.com, yro.slashdot.org, bleepingcomputer.com, Malware, Microsoft, News, Arxiv, Podcasts, Fortiguard, Security Affairs, Ground, Daily, Reddit, Bsky, Rss, SecurityWeek •