Full Report
This short blog post is about abusing a privilege escalation bug that Microsoft recently fixed in Windows, CVE-2026-66804, that I and 14 others reported. This issue is an incomplete fix for CVE-2026-50343, a bug dubbed “Dark Elevator” by Calif. The root cause of the bug was a dangling COM object registration for the CrossDevice COM object with the CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}. A COM registration typically needs two parts: a server executable, which for in-process components is a DLL and a CLSID entry under the HKEY_CLASSES_ROOT registry key which points to that DLL.
Analysis Summary
# Vulnerability: Windows Dangling COM Object Privilege Escalation
## CVE Details
- **CVE ID:** CVE-2026-66804 (Secondary/Incomplete fix for CVE-2026-50343, aka "Dark Elevator")
- **CVSS Score:** Not explicitly listed in text, but categorized as Privilege Escalation (typically 7.0–7.8 range)
- **CWE:** CWE-427 (Uncontrolled Search Path Element) / CWE-94 (Improper Control of Generation of Code)
## Affected Systems
- **Products:** Microsoft Windows
- **Versions:** Systems unpatched prior to the September 2026 update cycle.
- **Configurations:** Systems where the "CrossDevice" COM object registration exists without the corresponding DLL being present in a secure directory.
## Vulnerability Description
The vulnerability stems from a **dangling COM object registration**. The CrossDevice COM object (CLSID: `{E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}`) was registered in the system-wide registry (`HKEY_CLASSES_ROOT`), making it accessible to all users.
The registration pointed to a non-existent DLL located at:
`%PROGRAMDATA%\CrossDevice\CrossDevice.Streaming.Source.dll`
Because `C:\ProgramData` allows all users to create directories by default, a low-privileged user can create the expected folder structure and plant a malicious DLL. By forcing a privileged service to unmarshal a "Custom OBJREF" pointing to this CLSID, the privileged service loads the attacker's DLL, resulting in code execution at the service's integrity level (typically SYSTEM).
## Exploitation
- **Status:** PoC Available (Reported by Project Zero; exploit attached to issue tracker).
- **Complexity:** Medium (Requires bypass of COM marshaling mitigations).
- **Attack Vector:** Local (Requires the ability to write to ProgramData and call COM interfaces).
## Impact
- **Confidentiality:** High (Full system access)
- **Integrity:** High (Full system access)
- **Availability:** High (Full system access)
## Remediation
### Patches
- Microsoft released a definitive fix in late 2026 to remove the dangling registry entry or harden the service loading it. Users should apply all Windows Updates from September 2026 onwards.
### Workarounds
- Manually delete the registry key: `HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}`.
- Restrict write permissions to the `%PROGRAMDATA%\CrossDevice` directory if it exists.
## Detection
- **Indicators of Compromise:**
- Creation of the directory `C:\ProgramData\CrossDevice\`.
- Presence of an unexpected DLL named `CrossDevice.Streaming.Source.dll`.
- Unusual child processes spawning from privileged services (e.g., `InstallService`).
- **Detection Methods:**
- Use PowerShell to audit for dangling COM registrations where the `InProcServer32` path points to writable locations like `C:\Users` or `C:\ProgramData`.
## References
- **Vendor Advisory:** [Microsoft Security Response Center](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66804)
- **Project Zero Blog:** hxxps://projectzero[.]google[.]com/2026/09/windows-dangling-com.html
- **Calif Research (Original Bug):** hxxps://github[.]com/califio/publications/blob/main/MADBugs/windows-CVE-2026-50343/blog.md
- **Issue Tracker:** hxxps://project-zero[.]issues[.]chromium[.]org/issues/538151139