Researcher releases SignDrop exploit claiming Windows SYSTEM access

Security researcher Abdelhamid Naceri released SignDrop, a Windows zero-day exploit he says can give attackers SYSTEM privileges and bypass antivirus tamper protection, BleepingComputer reported. The flaw concerns authentication-file creation in the Common Log File System driver, exploiting logic introduced with Microsoft's October 2025 security mitigation. Naceri says a privileged process can be induced to open a log file, causing an authentication file to be created with SYSTEM privileges but the original file's access permissions. He tested the exploit on Windows 11 26H2 and experimental Windows builds. He says no fix is currently available and warns that disabling the mitigation would expose devices to other attacks.