Windows Exploitation Techniques: Dangling COM Object Registrations
Project Zero details patched Windows CVE-2026-66804, a privilege escalation via a dangling COM registration.
Google Project Zero describes CVE-2026-66804, a Windows local privilege escalation that Microsoft has fixed and that the author and 14 others reported. It is an incomplete fix for CVE-2026-50343, previously dubbed Dark Elevator. A system-wide COM registration for the CrossDevice class referenced a missing DLL under ProgramData, a directory local users can create, so a planted library could be loaded into a privileged process. After the earlier installer-service path was closed, the post explains that custom COM marshaling could still target a privileged service that had not disabled it.
- CVE-2026-66804 is described as an incomplete fix for CVE-2026-50343.
- A system-wide CrossDevice COM class pointed at a missing ProgramData DLL.
- Ordinary users could create that location and plant a DLL.
- Custom marshaling remained available after an earlier service path was closed.
- Microsoft has fixed the bug; live exploitation is not reported.
- Tags
- windowsprivilege-escalationcomcve-2026-66804cve-2026-50343project-zerolocal-privilege-escalation
- Vendors
- Microsoft
- Products
- Windows
- Organizations
- Google Project Zero
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-50343 | Improper privilege management in Microsoft Install Service allows an authorized attacker to elevate privileges locally | 7.8 | <1% | ||
| CVE-2026-66804 | Local Privilege Escalation in Microsoft Windows Cross Device Service | 7.8 | 5% |
From the original article
8 min read at projectzero.googleThis short blog post is about abusing a privilege escalation bug that Microsoft recently fixed in Windows, CVE-2026-66804, that I and 14 others reported. This issue is an incomplete fix for CVE-2026-50343, a bug dubbed “Dark Elevator” by Calif. The root cause of the bug was a dangling COM object registration for the CrossDevice COM object with the CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}.
By James Forshaw · projectzero.google
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.