Windows Dangling COM Object Registration Local Privilege Escalation (CVE-2026-66804, incomplete fix for CVE-2026-50343 'Dark Elevator')

Key facts

Detection coverage

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5581 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CrossDevice.Streaming.Source.dll Loaded From ProgramData Into a Privileged Process — Post-Exploitation

Detects any process loading CrossDevice.Streaming.Source.dll or any DLL from C:\ProgramData\CrossDevice\. In the exploit chain a privileged COM activator (InstallService running as LocalSystem, the Shell Create Object Handler, or Windows Camera Frame Server running as LOCAL SERVICE) instantiates CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496} and loads the attacker DLL, yielding code execution as SYSTEM or LOCAL SERVICE.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1574.001, T1559.001, T1068
• Data sources: sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode 7, DeviceImageLoadEvents
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7 (ImageLoaded="*\\CrossDevice.Streaming.Source.dll" OR ImageLoaded="C:\\ProgramData\\CrossDevice\\*")
| stats count min(_time) as first_seen max(_time) as last_seen values(ImageLoaded) as loaded_dll values(Hashes) as hashes values(Signed) as signed values(Signature) as signer by host, Image, User
| convert ctime(first_seen) ctime(last_seen)
| eval detection="TL-2026-5581 CrossDevice COM server DLL loaded from ProgramData (T1574.001, T1559.001)"

Microsoft KQL

DeviceImageLoadEvents
| where Timestamp > ago(24h)
| where FileName =~ "CrossDevice.Streaming.Source.dll" or FolderPath startswith @"C:\ProgramData\CrossDevice\"
| summarize LoadCount = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), SHA256s = make_set(SHA256) by DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName

Sigma

title: CrossDevice COM Server DLL Loaded From ProgramData (CVE-2026-66804)
id: 7b2d94e1-5c3a-4f68-a1d0-2e8c6f35b002
status: experimental
description: Detects a process loading CrossDevice.Streaming.Source.dll or any DLL from C:\ProgramData\CrossDevice, indicating a privileged COM activator resolved the dangling CrossDevice CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496} to an attacker-controlled DLL.
references:
  - https://projectzero.google/2026/09/windows-dangling-com.html
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66804
  - https://blog.calif.io/p/dark-elevator-windows-install-service
author: Threadlinqs Team
date: 2026-11-09
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.t1574.001
  - attack.t1559.001
  - attack.t1068
  - cve.2026-66804
  - cve.2026-50343
logsource:
  category: image_load
  product: windows
detection:
  selection_name:
    ImageLoaded|endswith: '\CrossDevice.Streaming.Source.dll'
  selection_path:
    ImageLoaded|startswith: 'C:\ProgramData\CrossDevice\'
  condition: 1 of selection_*
falsepositives:
  - Legitimate Cross Device components on a build where the DLL is properly installed and signed by Microsoft
level: high

Known false positives:

• Legitimate Cross Device components loading a properly installed, Microsoft-signed DLL from this path on future builds
• Security testing of the public PoC on lab hosts

Tuning notes: Enable Sysmon ImageLoad (EID 7) for this path; common community configs exclude most DLL loads. Where a legitimate signed build is observed, allow-list on Signed=true and a Microsoft signer. Pivot on host, Image and User to identify the exploited service (InstallService, Camera Frame Server, Shell Create Object Handler).

• 🔒 COM Registration Tamper: CrossDevice CLSID or InprocServer32 Pointing Into User-Writable Paths — Exploitation · unlock with TL Creds
• 🔒 Windows Camera Frame Server Spawning Shells or LOLBins — Post-Exploitation Token Abuse · unlock with TL Creds
• 🔒 InstallService [indicator] Modified by Non-SYSTEM Account (Dark Elevator / CVE-2026-50343 Vector) · unlock with TL Creds
• 🔒 Unsigned DLL From ProgramData Loaded by SYSTEM or Service Account Process · unlock with TL Creds
• 🔒 GodPotato or Service-Token Impersonation Leading to SYSTEM Shell — Post-Exploitation · unlock with TL Creds
• 🔒 Command Line References to CrossDevice Dangling COM CLSID, InstallService Plugin Map or OleViewDotNet · unlock with TL Creds
• 🔒 CrossDevice Dangling COM Server DLL Planted Under ProgramData (CVE-2026-66804) — Exploitation · unlock with TL Creds
• 🔒 Shell CreateObjectTask Started by Non-SYSTEM Account (Project Zero COM Marshaling Chain) · unlock with TL Creds

Indicators of compromise

As of 2026-11-09, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-5581.

Sample indicators (2 of 13)

• URL: hxxps://github[.]com/Rat5ak/CVE-2026-66804-CrossDevice-Service-EoP
• URL: hxxps://github[.]com/califio/publications

Defanged, TLP:CLEAR. Full set of 13 indicators: unlock with TL Creds.

Technical analysis

Public PoC code exists; no in-the-wild exploitation is reported.

Project Zero's James Forshaw (2026-09-21) describes a class of bug he calls a dangling COM object registration: a COM class is registered under the system-wide HKLM classes key, so every user and system service can resolve it, but the InprocServer32 DLL it points to is missing. If the missing path is in a location standard users can write, an unprivileged user can create the file and any privileged process that instantiates the class loads attacker-controlled code. The concrete instance is CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}, a Windows-shipped CrossDevice streaming/virtual-camera class whose server DLL is expected at C:\ProgramData\CrossDevice\CrossDevice.Streaming.Source.dll. C:\ProgramData is writable by standard users, so the directory and DLL can be created.

The same dangling registration was first abused in CVE-2026-50343 ('Dark Elevator', Calif, reported 2026-05-20, fixed 2026-07-14). That chain combined two logic flaws: the InstallService (LocalSystem) reads a plugin map (StaticPluginMap under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\InstallService\State) that standard users could write, letting them point the service at an arbitrary CLSID, and the CrossDevice CLSID's server DLL could be planted under %PROGRAMDATA%. Microsoft's fix addressed the InstallService vector, but the dangling registration itself remained, so other privileged COM activators could still be steered to it. CVE-2026-66804 (published 2026-08-11, Windows Cross Device Service, CWE-284, CVSS 7.8) is the fix for the dangling registration and is described by Project Zero as an incomplete fix for CVE-2026-50343. The post notes the issue was reported by the author and 14 others, and the tracker entry is Project Zero issue 538151139. The post also references the Shell Create Object Handler COM service (class 135fd325-45b7-4c30-89f8-4386961669f0), the scheduled task \Microsoft\Windows\Shell\CreateObjectTask and the named event Global\ShellCreateObjectTaskReadyEvent, and a custom COM marshaling technique used to get a SYSTEM-hosted COM service to load the planted DLL; a working exploit is attached to the Project Zero tracker.

Separately, an independent public PoC repository (Rat5ak/CVE-2026-66804-CrossDevice-Service-EoP, credited by SecurityOnline to Daniel Wade of nadsec) claims a different trigger: the Windows Camera Frame Server (LOCAL SERVICE) loads the planted DLL when the virtual camera is started, and the service token's SeImpersonatePrivilege is then abused with GodPotato-derived code to reach SYSTEM. Per the README, the report was submitted to MSRC on 2026-06-01 and closed as a duplicate on 2026-07-27. These claims come from the repository and a secondary news source and were not independently verified. Preconditions per secondary reporting: the HKLM CrossDevice COM registration exists and C:\ProgramData\CrossDevice is absent; systems where the DLL already exists with protected permissions are not exploitable by this path. CISA's SSVC entry records exploitation as none, not automatable, technical impact total. Defender guidance: patch, audit HKLM COM registrations for InprocServer32 targets that do not resolve, review standard-user write access under C:\ProgramData, monitor DLL loads from user-writable paths into SYSTEM or service processes, and enforce strong COM unmarshaling policy (COMGLB_UNMARSHALING_POLICY_STRONG) or EOAC_NO_CUSTOM_MARSHAL where custom marshaling is not required.

MITRE ATT&CK techniques by tactic:

Privilege Escalation

T1053.005 Scheduled Task/Job: Scheduled Task

defense-impairment

T1112 Modify Registry

Defense Evasion

T1134.001 Access Token Manipulation: Token Impersonation/Theft

Persistence

T1546.015 Event Triggered Execution: Component Object Model Hijacking

Execution

T1559.001 Inter-Process Communication: Component Object Model

stealth

T1574 Hijack Execution Flow

Remediation

Patches

• CVE-2026-66804 fixed in Windows 10 22H2 10.0.19045.7663, Windows 11 24H2 10.0.26100.9168, Windows 11 25H2 10.0.26200.9168, Windows 11 26H1 10.0.28000.2704 (per NVD/CVE record; confirm in MSRC advisory)
• CVE-2026-50343 fixed in the 2026-07-14 Patch Tuesday update

Immediate actions

• Install the August 2026 Windows security updates containing the CVE-2026-66804 fix, and the July 2026 update for CVE-2026-50343
• Hunt for creation of C:\ProgramData\CrossDevice and CrossDevice.Streaming.Source.dll by non-administrative accounts
• Search endpoints for the CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496} and unexpected copies of the public PoC packages

Workarounds

• Where the Cross Device virtual camera is not needed, disable or remove the component through management tooling
• Pre-create C:\ProgramData\CrossDevice with administrator-only permissions on unpatched systems
• Limit interactive local access on shared systems until patched

Longer-term hardening

• Audit HKLM\SOFTWARE\Classes\CLSID InprocServer32/LocalServer32 entries for targets that do not exist on disk
• Review standard-user write access under C:\ProgramData and any path referenced by a COM server registration
• Audit ACLs on HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\InstallService\State and other COM/installer plugin keys
• Enforce strong COM unmarshaling policy (COMGLB_UNMARSHALING_POLICY_STRONG) or EOAC_NO_CUSTOM_MARSHAL in services that do not need custom marshaling

Affected and fixed versions

• Microsoft — Windows 10 22H2
  Vulnerable versions: 10.0.19045.0 to before 10.0.19045.7663
  Fixed in: 10.0.19045.7663
• Microsoft — Windows 11 24H2
  Vulnerable versions: 10.0.26100.0 to before 10.0.26100.9168
  Fixed in: 10.0.26100.9168
• Microsoft — Windows 11 25H2
  Vulnerable versions: 10.0.26200.0 to before 10.0.26200.9168
  Fixed in: 10.0.26200.9168
• Microsoft — Windows 11 26H1
  Vulnerable versions: 10.0.28000.0 to before 10.0.28000.2704
  Fixed in: 10.0.28000.2704

Timeline

• 2026-05-20 Calif reports the InstallService / CrossDevice COM chain (later CVE-2026-50343) to Microsoft.
• 2026-06-01 Independent researcher submits the CrossDevice virtual camera dangling-registration issue to MSRC (per the public PoC repository README).
• 2026-07-14 Microsoft fixes CVE-2026-50343 in the July 2026 Patch Tuesday update.
• 2026-07-22 Calif publishes the 'Dark Elevator' write-up and PoC materials for CVE-2026-50343.
• 2026-07-27 CVE-2026-66804 is reserved; MSRC closes the independent CrossDevice report as a duplicate.
• 2026-08-11 Microsoft publishes CVE-2026-66804 (Windows Cross Device Service EoP, CVSS 7.8) and ships the fix in August 2026 Patch Tuesday.
• 2026-08-18 SecurityOnline reports a public PoC for CVE-2026-66804 and no confirmed in-the-wild exploitation.
• 2026-09-21 Google Project Zero publishes 'Windows Exploitation Techniques: Dangling COM Object Registrations', describing CVE-2026-66804 as an incomplete fix for CVE-2026-50343 and attaching a working exploit to the issue tracker.

Sources cited

• CVE-2026-66804 CVE record (Microsoft Windows Cross Device Service Elevation of Privilege) MITRE · Advisory · 2026-08-11
• NVD: CVE-2026-50343 Microsoft Install Service EoP NVD (NIST) · Advisory · 2026-07-14
• Windows Exploitation Techniques: Dangling COM Object Registrations (James Forshaw, Google Project Zero) projectzero.google · Research · 2026-09-21
• Microsoft Security Update Guide: CVE-2026-66804 Microsoft Security Response Center · Vendor report · 2026-08-11
• Dark Elevator: Windows Install Service Local Privilege Escalation (CVE-2026-50343) blog.calif.io · Research · 2026-07-22
• CVE-2026-66804 CrossDevice Service EoP PoC repository GitHub · Proof of concept · 2026-08-11
• Calif publications repository (CVE-2026-50343 PoC materials) GitHub · Code repository · 2026-07-22
• CVE-2026-66804 System Privileges (SecurityOnline) securityonline.info · News · 2026-08-18

More in vulnerability

• "Office Party" flaw in Anthropic Claude DOCX/PPTX/XLSX skills (soffice.py LD_PRELOAD shim) enables code execution on Linux
• ForgeRock Attack Chain: Default admin:admin Felix Console Credentials and WAF Path-Encoding Bypass Lead to RCE and Remote Vehicle Unlock at Two Automakers
• WidzialniCMS < 2.5 unauthenticated file upload RCE (CVE-2026-110468, CVE-2026-110469) plus reflected XSS (CVE-2026-112204) and login lockout bypass (CVE-2026-112205)
• ModSecurity WAF Vulnerabilities: Multipart filename* Upload Bypass (CVE-2026-104269) and XML Body Processor Uninitialized Pointer Dereference (CVE-2026-73857)
• Web3Auth Infrastructure Flaw Exploited to Drain Keplr Wallets Created via Google/Apple Sign-in (Private Key Breach)