Windows COM Flaw Allows SYSTEM Privilege Escalation via Malicious DLL
A critical Windows privilege escalation vulnerability, CVE-2026-66804, allows local attackers to gain SYSTEM privileges by exploiting a dangling COM object registration.
A newly detailed Windows privilege escalation flaw, tracked as CVE-2026-66804, has been disclosed, allowing a standard, low-privileged user to plant a malicious DLL and execute arbitrary code with full NT AUTHORITY\SYSTEM privileges. This vulnerability exploits a lingering weakness in how Windows handles Component Object Model (COM) registrations, specifically targeting the CrossDevice component, which is integral to features like Phone Link and cross-device file sharing.
The root of the problem lies in a dangling COM object registration for the Windows CrossDevice component. The object, registered under a specific CLSID, was accessible system-wide. Crucially, the DLL it pointed to, located in the %PROGRAMDATA% directory, did not exist on affected systems. This path, residing within C:\ProgramData, is writable by any standard user, enabling an attacker to place a malicious DLL in the expected location. When the COM object was instantiated, it would then load the attacker-controlled code.
This is not the first time the CrossDevice registration has been a source of vulnerabilities. The original bug, CVE-2026-50343, dubbed "Dark Elevator," exploited weak registry key permissions. While Microsoft patched the initial issue in July 2026, the underlying dangling COM reference persisted, prompting researchers to find an alternative activation path. The new exploit leverages a technique involving custom COM marshaling, where an attacker can force a privileged process to load a planted DLL during the unmarshaling process.
Microsoft had anticipated such abuse by implementing hardening controls like EOAC_NO_CUSTOM_MARSHAL. However, the exploit succeeds by targeting a specific SYSTEM COM server, the Shell Create Object Handler, which neglected to enable these crucial security settings. This server runs within a SYSTEM dllhost process and still allows custom marshaling, making it susceptible to the attack.
The exploitation chain involves launching a scheduled task that keeps the vulnerable SYSTEM COM server alive. The attacker then passes a fake marshaled object through the object's ICreateObject interface. This action triggers the unconditional unmarshaling process, leading to the malicious DLL being loaded directly into the SYSTEM process, thereby achieving full privilege escalation.
Microsoft has assigned CVE-2026-66804 a High severity rating with a CVSS score of 7.8. The vulnerability is exploitable locally by an authenticated user and requires no user interaction. Proof-of-concept exploit code has already surfaced publicly, and commercial exploitation modules are available, highlighting the immediate risk to unpatched systems.
Administrators are urged to apply the August 2026 cumulative updates without delay, as these patches remove the dangling registration that enables this attack. Beyond this specific fix, the vulnerability serves as a stark reminder that dangling COM registrations can remain a significant and often overlooked source of local privilege escalation bugs in Windows environments.
Researchers suggest that defenders can proactively identify similar vulnerabilities by scanning for in-process COM classes whose registered DLLs cannot be resolved on disk and then verifying if an attacker could plant a malicious replacement. This discovery underscores the ongoing need for diligent vulnerability management and timely patching of Windows systems.