A security researcher who goes by the name Nightmare Eclipse has published exploit code for an unpatched Windows vulnerability, a type of flaw known as a zero-day.
The researcher, identified as Abdelhamid Naceri, released the proof-of-concept code on Friday, November 13. He calls it SignDrop and linked to the code on GitHub.
SignDrop is a local privilege-escalation exploit, meaning a user who already has access to a device can raise their rights to SYSTEM, the highest level on Windows. It abuses flawed logic in the Common Log File System, a kernel-mode component of the operating system, and it also involves Windows Defender, Microsoft’s built-in antimalware tool.
Naceri says he tested the exploit on Windows 11 26H2, an experimental build of Windows 11 26H2 and an experimental build of Windows Server 2025. He claims it should work on about 80 percent of Windows installations and says a system is generally vulnerable if its Windows installation is older than 90 days.
The security firm Cyderes compiled and tested the proof-of-concept code. It found no evidence that the flaw has been exploited in the wild.
Microsoft said it is actively investigating the reported vulnerability. A company spokesperson said Microsoft Defender detects and blocks exploitation of the flaw and that Microsoft has not observed exploitation in the wild. The company said it will take the necessary steps to update affected products as soon as possible.
No patch or vulnerability identifier had been reported as of Friday. Last year, Microsoft introduced log file authentication for the Common Log File System as a mitigation against attacks on the component.
