New Windows SignDrop zero-day gives hackers SYSTEM privileges

Security researcher Abdelhamid Naceri has released SignDrop, a Windows zero-day exploit that abuses a mitigation Microsoft added in October 2025 for Common Log File System (CLFS) authentication attacks, letting an attacker trick a privileged process such as Windows Defender into creating a file with SYSTEM privileges and elevating their own access. Naceri estimates about 80% of Windows installations are vulnerable, and there is currently no fix other than waiting for a Microsoft patch.