Windows COM Flaw Lets Attackers Gain SYSTEM Privileges With a Malicious DLL
Project Zero details CVE-2026-66804, a Windows COM flaw giving SYSTEM via planted DLL; patched in August, PoC and commercial module public.
CVE-2026-66804 (CVSS 7.8, High) lets an authenticated local user plant a malicious DLL in %PROGRAMDATA%\CrossDevice\ that a SYSTEM process loads through a dangling COM registration for the Windows CrossDevice component, chained via custom COM marshaling in the Shell Create Object Handler. It is an incomplete fix for the earlier 'Dark Elevator' bug CVE-2026-50343. Microsoft patched it in the August 2026 Patch Tuesday, but public PoC code has surfaced and at least one commercial exploitation module automates the LOCAL SERVICE-to-SYSTEM chain.
- CVE-2026-66804 (CVSS 7.8) escalates standard users to SYSTEM via dangling CrossDevice COM registration
- Incomplete fix for 'Dark Elevator' CVE-2026-50343, chained through COM custom marshaling
- Public PoC exists; commercial module automates LOCAL SERVICE-to-SYSTEM chain
- Fixed in August 2026 cumulative updates
- Organizations
- MicrosoftGoogle Project Zero
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-50343 | Improper privilege management in Microsoft Install Service allows an authorized attacker to elevate privileges locally | 7.8 | <1% | ||
| CVE-2026-66804 | Local Privilege Escalation in Microsoft Windows Cross Device Service | 7.8 | 5% |
From the original article
3 min read at cybersecuritynews.com
A newly detailed Windows privilege escalation flaw tracked as CVE-2026-66804 allowed a standard, low-privileged user to plant a malicious DLL and execute arbitrary code with full NT AUTHORITY\SYSTEM privileges, exploiting a lingering weakness in how Windows handles Component Object Model (COM) registrations. The bug, patched by Microsoft in its August Patch Tuesday, was reported by […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.