CVE-2026-66804: dangling COM registration leads to SYSTEM in Windows
أساليب الهجوم وتقنياته2026-09-24, 12:00
James Forshaw from Google Project Zero analyzed CVE-2026-66804 — an LPE in Windows caused by an incomplete fix for the earlier CVE-2026-50343 (Dark Elevator).
The system retained a CrossDevice COM registration with the CLSID
{E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}, pointing to a missing %PROGRAMDATA%\CrossDevice\CrossDevice.Streaming.Source.dll. Because regular users can create directories under C:\ProgramData, an attacker can plant their own DLL at the expected path.The main challenge is getting a privileged process to load it. Forshaw used custom COM marshaling: an object implementing
IMarshal can specify an arbitrary CLSID to use during unmarshaling, causing the COM runtime to look up the corresponding in-process server and load its DLL. Exploitation therefore requires a privileged COM server that does not disable custom marshaling. Forshaw found one in the Shell Create Object Handler, hosted in dllhost.exe as NT AUTHORITY\SYSTEM with CustomMarshalAllowed=True.A regular user can start the privileged server through the
\Microsoft\Windows\Shell\CreateObjectTask scheduled task, after creating the global ShellCreateObjectTaskReadyEvent event. The attacker can then pass a specially crafted COM object to the ICreateObject interface. During unmarshaling, COM resolves the CrossDevice CLSID and loads the planted DLL from %PROGRAMDATA% into the SYSTEM process, resulting in privilege escalation.Forshaw published a fully working exploit. He also included a PowerShell script using
OleViewDotNet and NtObjectManager to identify other registered in-process COM classes whose DLLs cannot be found by LoadLibrary. The resulting paths must then be manually checked to determine whether an attacker can plant a DLL there.Forshaw notes that the same exploitation technique can simplify exploitation of other dangling COM registrations and can also be applied to buggy custom COM unmarshalers.
الثغرات
المورّدون
المنتجات
المزيد