United StatesSignDrop, disclosed Tuesday, gives ordinary Windows users System rights.
Nightmare Eclipse says it can switch off any antivirus.
An attacker makes Defender open a crafted log container, and the logging service creates a missing file with System privileges.
Researcher Will Dormann reproduced it, but only 1 of his machines met the requirements.
Microsoft representatives did not answer a request for comment on a fix.
How each outlet framed it
- Ars Technica leans critical
- frames the exploit as Windows Defender turned against itself, tracing the CLFS flaw through the signature-update function
Sources: Ars Technica