I suspect some possible relation to SignDrop or attempts to patch it.

SignDrop is an unpatched Windows zero-day local privilege escalation (LPE) exploit that allows a standard user to gain NT AUTHORITY\SYSTEM privileges by abusing the Common Log File System (CLFS) kernel driver (clfs.sys). Security researcher Abdelhamid Naceri (also known as MSNightmare or Nightmare Eclipse) published a detailed technical write-up and functional proof-of-concept (PoC) code on GitHub on November 10, 2026.

▲

antx a day ago | parent | next [-]

Not impossible, but very unlikely. CLFS isn’t remotely reachable, it's a kernel driver reached through local API calls and has no network listener. AFAIK the historical CLFS CVEs are all rated as local.

▲

waz0wski 21 hours ago | parent [-]

There was an RCE recently disclosed for ... paint.exe - CVE-2026-83844

https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...

So really anything is on the table at this point

	▲	antx 10 hours ago \| parent [-]
		Except, once again Microsoft crapped the bed... it's not an RCE in any capacity... > Revision 2.1, Nov 7: “Added an FAQ and updated the CVSS score. This is an informational change only.” > Vector: now AV:L and UI:R (local attack vector, user interaction required), scoring 7.0.

▲

stackghost a day ago | parent | prev [-]

Are you finding these vulns with Mythos/Daybreak or some other tool? Chinese models perhaps?