Privilege Escalation via Dangling COM Object Registrations (CVE‑2026‑66804, CVE‑2026‑50343) in Windows
What It Is — Project Zero disclosed two related Windows privilege‑escalation bugs. CVE‑2026‑66804 is an incomplete fix for the earlier CVE‑2026‑50343 (“Dark Elevator”). Both stem from a dangling COM registration for the CrossDevice COM object (CLSID {E9F83CF2‑E0C0‑4CA7‑AF01‑E90C70BEF496}). The registration points to a non‑existent DLL under %PROGRAMDATA%\CrossDevice\CrossDevice.Streaming.Source.dll. Because C:\ProgramData is writable by any standard user, an attacker can drop a malicious DLL there, then trigger COM marshaling (including custom IMarshal‑by‑value) to have a privileged service load the DLL, achieving system‑level code execution. The technique works even after the original InstallService fix, demonstrating a residual attack surface in Windows’ COM infrastructure.
Affected Products — Microsoft Windows client and server editions that include the CrossDevice COM registration (e.g., Windows 10, Windows 11, Windows Server 2019/2022).
Why It Matters for Trust & Control Assurance — The flaw highlights the need for rigorous configuration control and privileged‑access safeguards; Verisq’s Control Mapping capability helps map such registry‑level gaps to a single control objective that spans multiple frameworks.
Recommended Actions —
- Deploy Microsoft’s security update that fully resolves CVE‑2026‑66804 and CVE‑2026‑50343.
- Audit the
HKCR\CLSIDregistry hive for entries that reference missing or user‑writable DLL paths, especially underC:\ProgramData. - Harden permissions on
C:\ProgramDatato prevent non‑admin write access where possible. - Enable monitoring for unexpected DLL creation in system‑wide locations and for COM activation events from low‑privilege accounts.
- Validate that custom COM marshaling interfaces are not exposed to untrusted callers.