Windows COM Flaw Lets Attackers Gain SYSTEM Privileges With a Malicious DLL

A newly detailed Windows privilege escalation flaw tracked as CVE-2026-66804 allowed a standard, low-privileged user to plant a malicious DLL and execute arbitrary code with full NT AUTHORITY\SYSTEM privileges, exploiting a lingering weakness in how Windows handles Component Object Model (COM) registrations.

The bug, patched by Microsoft in its August Patch Tuesday, was reported by a Google Project Zero researcher alongside 14 others and turned out to be an incomplete fix for an earlier flaw known as “Dark Elevator”.

The root of the problem lies in a dangling COM object registration for the Windows CrossDevice component the service behind Phone Link, clipboard sync, and cross-device file sharing.

The object, registered under the CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}, sat in the system-wide classes registry key, making it reachable by every user on the machine, including SYSTEM services.

Crucially, the DLL it pointed to %PROGRAMDATA%\CrossDevice\CrossDevice.Streaming.Source.dll did not actually exist on affected systems, and that path lives inside C:\ProgramData, a directory where any standard user can create folders and files.

That combination let an attacker plant an arbitrary DLL at the missing location, priming the COM object to load attacker-controlled code the moment it was instantiated.

This was not the first time the CrossDevice registration caused trouble. The original bug, CVE-2026-50343, dubbed “Dark Elevator” by researchers at Calif, abused weak registry key permissions to register the class as an installer plugin and coaxed the SYSTEM-level InstallService into loading it into memory.

Microsoft fixed the InstallService issue in July 2026, but the underlying dangling COM reference remained, forcing researchers to hunt for an alternative activation path.

According to Google Project Zero, the alternative came from a well-worn technique: abusing custom COM marshaling. When a COM interface method is implemented out-of-process, the runtime marshals its parameters into a remote procedure call, and objects passed as parameters are serialized into an OBJREF structure.

By default, COM marshals by reference, but an object implementing the IMarshal interface can opt into marshal-by-value and specify an arbitrary CLSID to be loaded during unmarshaling.

By pointing that CLSID at the dangling CrossDevice class, an attacker could force a privileged process to load the planted DLL automatically, before the target method ever runs.

The catch is that Microsoft anticipated this abuse. Since Windows 8, services can disable custom marshaling using the EOAC_NO_CUSTOM_MARSHAL flag in CoInitializeSecurity or the stronger COMGLB_UNMARSHALING_POLICY_STRONG setting via IGlobalOptions::Set.

To succeed, an attacker therefore needs a privileged SYSTEM COM server that neglects to enable these hardening controls.

The researcher located exactly such a target in the Shell Create Object Handler object (CLSID 135fd325-45b7-4c30-89f8-4386961669f0), a component previously studied and exploited that runs inside a SYSTEM dllhost process with custom marshaling still allowed.

Because the object has no backing service, it cannot be instantiated directly; instead, it must be launched through the user-startable \Microsoft\Windows\Shell\CreateObjectTask scheduled task, paired with a global ShellCreateObjectTaskReadyEvent to keep it alive.

With the SYSTEM server running, the exploit simply passes a fake marshaled object through the object’s lone ICreateObject interface, triggering unconditional unmarshaling and loading the malicious DLL into the SYSTEM process for full privilege escalation.

Microsoft rates CVE-2026-66804 as High severity with a CVSS score of 7.8, exploitable locally by an authenticated user with no user interaction required.

Proof-of-concept exploit code has since surfaced publicly, and at least one commercial exploitation module now automates the LOCAL SERVICE-to-SYSTEM chain, underscoring the practical risk to unpatched hosts.

Administrators should apply the August 2026 cumulative updates without delay, as the fix removes the dangling registration that enables the attack.

Beyond the specific patch, the research is a reminder that dangling COM registrations remain a fertile and often overlooked class of local privilege escalation bugs.

The same marshaling trick that exploits missing DLLs can also crash or subvert buggy custom unmarshalers, and defenders can proactively hunt for similar flaws by scanning in-process COM classes whose registered DLLs cannot be resolved on disk then checking whether an attacker could plant one.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC