[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-signdrop-windows-zero-day-gives-local-users-system-rights":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},13063,"signdrop-windows-zero-day-gives-local-users-system-rights","SignDrop Windows Zero-Day Gives Local Users System Rights","A researcher in a public feud with Microsoft disclosed SignDrop, which turns Windows Defender's own file handling into a route to full System control.","A researcher feuding with Microsoft has published SignDrop, a Windows zero-day (a flaw disclosed with no fix available) that lets a local user take full System rights.\n\nThe researcher goes by Nightmare Eclipse, a pseudonym, and disclosed the bug on Tuesday. It is the latest zero-day from the same person, who has an ongoing and very public beef with Microsoft. The flaw sits in the Common Log File System (CLFS), which Microsoft describes as a \"general-purpose logging service used by software clients running in user-mode or kernel-mode.\" It affects some versions of Windows.\n\nThe attack works by turning a defense against itself. An attacker with ordinary user rights forces a privileged process, such as Windows Defender, to open a crafted CLFS container, which is a log file the attacker created. The exploit gets Defender to do this by calling ServerMpUpdateEngineSignature, a legitimate Defender function for processing antivirus signature updates. Defender then creates files with its own elevated privileges, and the attacker abuses that to reach System, the highest privilege level on a Windows machine.\n\nThe word \"local\" limits the damage. An attacker must already be running code on the machine, so SignDrop is a second-stage tool rather than a way in. Second-stage tools still matter, because they turn a minor foothold into full control.\n\nThe disclosure also skips the usual order of events. Under coordinated disclosure, a vendor gets time to ship a fix before details go public. A zero-day drop hands defenders and attackers the same starting line.\n\nThe attack depends on three pieces interacting: CLFS, Defender, and Windows file permissions. Which of the three Microsoft decides to change is the open question.","[\"windows\",\"zero-day\",\"privilege-escalation\",\"microsoft\"]","2026-11-13T16:26:32.000Z","2026-11-14T00:19:33.667Z","2026-11-14T00:20:27.246Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Replace the unsupported 'November 10' date with 'Tuesday', which is all the source gives, or verify it independently. Also cut or clearly label as speculation the claims that the flaw is 'hard to patch away with a single permission tweak' because Defender 'is behaving as designed', and that the researcher publishes 'out of spite'. The source says only 'disgruntled' and describes a public beef, and it says nothing about patch difficulty.","resolved","security",[32,33,34,35],"windows","zero-day","privilege-escalation","microsoft",[37],{"name":38,"url":39},"Ars Technica","https:\u002F\u002Farstechnica.com\u002Fsecurity\u002F2026\u002F11\u002Fwindows-0-day-dropped-by-disgruntled-researcher-hands-hackers-system-rights\u002F",0,{"sections":42},[43,48,51,56,61,66,71,76,81,86,91,96,101,106],{"name":44,"slug":45,"count":46,"latest_published_at":47},"AI","ai",7151,"2026-11-13T11:05:00.000Z",{"name":49,"slug":30,"count":50,"latest_published_at":18},"Security",1135,{"name":52,"slug":53,"count":54,"latest_published_at":55},"Deals","deals",656,"2026-11-13T15:00:00.000Z",{"name":57,"slug":58,"count":59,"latest_published_at":60},"Policy","policy",624,"2026-11-13T13:58:05.000Z",{"name":62,"slug":63,"count":64,"latest_published_at":65},"Consumer Tech","consumer-tech",372,"2026-11-13T14:37:16.000Z",{"name":67,"slug":68,"count":69,"latest_published_at":70},"Hardware","hardware",340,"2026-11-13T15:23:48.000Z",{"name":72,"slug":73,"count":74,"latest_published_at":75},"Science","science",232,"2026-11-13T12:00:40.000Z",{"name":77,"slug":78,"count":79,"latest_published_at":80},"Software","software",173,"2026-11-13T15:05:54.000Z",{"name":82,"slug":83,"count":84,"latest_published_at":85},"Startups","startups",161,"2026-11-13T15:21:46.000Z",{"name":87,"slug":88,"count":89,"latest_published_at":90},"Dev Tools","dev-tools",127,"2026-11-11T19:00:44.000Z",{"name":92,"slug":93,"count":94,"latest_published_at":95},"General","general",120,"2026-11-13T11:33:19.000Z",{"name":97,"slug":98,"count":99,"latest_published_at":100},"Gaming","gaming",109,"2026-11-13T10:00:00.000Z",{"name":102,"slug":103,"count":104,"latest_published_at":105},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":107,"slug":108,"count":109,"latest_published_at":110},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]