SignDrop: a public Windows local privilege escalation to SYSTEM that turns Microsoft's CLFS authentication mitigation against itself through Defender's signature-update RPC; proof of concept published 2026-11-10, no CVE and no patch, no exploitation reported

Cyderes Howler Cell reports that the exploit was published on 2026-11-10 under a GitHub handle, the same day as November Patch Tuesday, with no coordinated disclosure, no CVE and no patch, and that its team reproduced a SYSTEM shell from a standard user session (Cyderes, 2026-11-12). The chain is a logic bug with no memory corruption: CLFS containers are created through Object Manager symbolic links, an oplock on a bait file confirms that Microsoft Defender has engaged, a call to Defender's signature-update RPC makes clfs.sys create its .cnpf authentication-signature file as SYSTEM at an attacker-chosen path, here hid.dll in the Common Files\microsoft shared\ink directory, a file that does not ship in that directory; the content is replaced with a payload DLL and a runas request makes consent.exe load it, which starts a SYSTEM conhost.exe on the user's desktop (Cyderes, 2026-11-12). Like every release of the same cluster it needs a foothold on the host first. It applies where the CLFS authentication Mode value, under HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication, is 0 or 1 (Cyderes, 2026-11-12).

Cyderes says the feature ships enabled on current Windows versions and that the researcher tested Windows 11 26H2 and experimental builds of Windows 11 and Windows Server 2025; the researcher's estimate that 80% of Windows installations are vulnerable has no data behind it (Cyderes, 2026-11-12). The researcher adds that, because the privileged file creation appears to come from the antimalware engine's own process, the technique can be used against any antimalware engine's self-defense; that claim rests on his statement alone (BleepingComputer, 2026-11-12). No source reports exploitation, and Microsoft had not commented publicly as of 2026-11-11 (SecurityOnline, 2026-11-11).

Triage: Cyderes calls a hid.dll creation in the ink directory and a Defender signature-update RPC from outside the Defender service tree rare enough in a typical estate to alert on rather than hunt, and the first is a successful write whatever the variant (Cyderes, 2026-11-12).