{
  "id": 19911169,
  "title": "Windows 0-Day Dropped By Disgruntled Researcher Hands Hackers System Rights",
  "url": "https://urgent.news/2026/11/14/windows-0-day-dropped-by-disgruntled-researcher-hands-hackers-system",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-14T03:30:00.000Z",
  "source": {
    "name": "Slashdot",
    "slug": "slashdot",
    "url": "https://it.slashdot.org/story/26/11/14/020218/windows-0-day-dropped-by-disgruntled-researcher-hands-hackers-system-rights"
  },
  "original_language": "en",
  "account": "An anonymous researcher, known online as Nightmare Eclipse, has disclosed a new Windows zero-day vulnerability dubbed SignDrop. The flaw allows local users to gain full System rights on certain versions of Windows. The vulnerability exists in the Common Log File System, a general-purpose logging service utilized by software clients operating in user-mode or kernel-mode. By tricking a privileged process like Windows Defender into opening a specially crafted Common Log File System (CLFS) container, an attacker with basic user privileges can exploit the elevated file creation rights to attain System-level access.\n\nWill Dormann, a researcher who has had a long-standing dispute with Microsoft, confirmed the exploit and its functionality. However, he noted that the attack is not universally applicable to all Windows 11 versions. The vulnerability requires the system to be running Windows 26H2, with an additional condition that the HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\CLFS\\Authentication\\Mode value must be set to either 0 or 1. Dormann's testing revealed that only one of the multiple machines he used met these requirements.\n\nMicrosoft responded by stating that they are investigating the vulnerability and have found no evidence of it being exploited in the wild. The company also mentioned that their Defender software is capable of blocking potential exploitation attempts.",
  "summary": "An anonymous reader quotes a report from Ars Technica: Nightmare Eclipse, the pseudonym of a researcher with an ongoing, very public beef with Microsoft, has dropped yet another Windows zero-day. On Tuesday, Nightmare Eclipse disclosed SignDrop, a vulnerability that gives local users full System rights on some versions of Windows. The vulnerability resides in the Common Log File System, which…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "Ars Technica",
        "title": "Windows 0-day dropped by disgruntled researcher hands hackers System rights",
        "url": "https://urgent.news/2026/11/13/windows-0-day-dropped-by-disgruntled-researcher-hands-hackers-system",
        "published": "2026-11-13T16:26:32.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}