CVE-2026-66804: dangling COM registration leads to SYSTEM in Windows

James Forshaw from Google Project Zero analyzed CVE-2026-66804 — an LPE in Windows caused by an incomplete fix for the earlier CVE-2026-50343 (Dark Elevator).

The system retained a CrossDevice COM registration with the CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}, pointing to a missing %PROGRAMDATA%\CrossDevice\CrossDevice.Streaming.Source.dll. Because regular users can create directories under C:\ProgramData, an attacker can plant their own DLL at the expected path.

The main challenge is getting a privileged process to load it. Forshaw used custom COM marshaling: an object implementing IMarshal can specify an arbitrary CLSID to use during unmarshaling, causing the COM runtime to look up the corresponding in-process server and load its DLL. Exploitation therefore requires a privileged COM server that does not disable custom marshaling. Forshaw found one in the Shell Create Object Handler, hosted in dllhost.exe as NT AUTHORITY\SYSTEM with CustomMarshalAllowed=True.

A regular user can start the privileged server through the \Microsoft\Windows\Shell\CreateObjectTask scheduled task, after creating the global ShellCreateObjectTaskReadyEvent event. The attacker can then pass a specially crafted COM object to the ICreateObject interface. During unmarshaling, COM resolves the CrossDevice CLSID and loads the planted DLL from %PROGRAMDATA% into the SYSTEM process, resulting in privilege escalation.

Forshaw published a fully working exploit. He also included a PowerShell script using OleViewDotNet and NtObjectManager to identify other registered in-process COM classes whose DLLs cannot be found by LoadLibrary. The resulting paths must then be manually checked to determine whether an attacker can plant a DLL there.

Forshaw notes that the same exploitation technique can simplify exploitation of other dangling COM registrations and can also be applied to buggy custom COM unmarshalers.

Article: https://projectzero.google/2026/09/windows-dangling-com.html

PoC: https://project-zero.issues.chromium.org/issues/538151139