Windows privilege escalation CVE-2026-66804: dangling CrossDevice COM registration loaded planted DLLs as SYSTEM

Google Project Zero discloses patched Windows flaw CVE-2026-66804 (CVSS 7.8), an incomplete fix for 'Dark Elevator' (CVE-2026-50343) that let any authenticated local user get SYSTEM via a planted DLL; a public PoC and a commercial module exist, though no live…

Google Project Zero (2026-09-21) disclosed CVE-2026-66804, a Windows local privilege-escalation bug reported by the Project Zero author and 14 other researchers and already fixed by Microsoft in the August 2026 Patch Tuesday cumulative updates. Cyber Security News (2026-09-22), which rates the flaw CVSS 7.8 (High), explains the chain: a system-wide COM registration for the CrossDevice class referenced a missing DLL in the user-writable %PROGRAMDATA%\CrossDevice\ directory, so an authenticated local user could plant a malicious DLL there and have a SYSTEM process load it, with the chain completed through custom COM marshaling in the Shell Create Object Handler. Both sources identify CVE-2026-66804 as an incomplete fix for CVE-2026-50343, the earlier privilege escalation dubbed 'Dark Elevator': after the earlier installer-service path was closed, custom COM marshaling could still target a privileged service that had not disabled it. Although Microsoft has patched the bug, public PoC code has surfaced and at least one commercial exploitation module automates the LOCAL SERVICE-to-SYSTEM chain (Cyber Security News), while Project Zero states that live exploitation is not reported — the sources are complementary rather than conflicting, distinguishing available tooling from observed in-the-wild attacks.

• CVE-2026-66804 is a Windows local privilege escalation rated CVSS 7.8 (High) by Cyber Security News.
• A system-wide COM registration for the CrossDevice class pointed at a missing DLL under %PROGRAMDATA%\CrossDevice\, a location ordinary local users can create, so a planted library could load into a privileged SYSTEM process.
• The chain runs through custom COM marshaling in the Shell Create Object Handler, which remained usable after the earlier installer-service path was closed because a privileged service had not disabled it.
• Both sources describe CVE-2026-66804 as an incomplete fix for CVE-2026-50343, the earlier privilege escalation dubbed 'Dark Elevator'.
• The bug was reported by the Project Zero author and 14 other researchers.
• Microsoft fixed CVE-2026-66804 in the August 2026 Patch Tuesday cumulative updates.
• Public PoC code has surfaced and at least one commercial module automates the LOCAL SERVICE-to-SYSTEM chain (Cyber Security News); Project Zero reports no live exploitation.