# Windows Dangling COM Object Registration Local Privilege Escalation (CVE-2026-66804, incomplete fix for CVE-2026-50343 'Dark Elevator')

> A CrossDevice COM class is registered machine-wide but its in-process server DLL (%PROGRAMDATA%\CrossDevice\CrossDevice.Streaming.Source.dll) does not exist, so a standard user can create the path and plant a DLL that a privileged process loads, yielding SYSTEM. CVE-2026-66804 (Windows Cross Device Service, CVSS 7.8) fixed it in August 2026 and is described as an incomplete fix for CVE-2026-50343. Public PoC code exists; no in-the-wild exploitation is reported.

- **Published:** 2026-11-09T20:04:29Z
- **Last reviewed:** 2026-11-09T20:04:29Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5581
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5581.png
- **ID:** TL-2026-5581
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 13 (2 shown free below)
- **CVEs:** CVE-2026-66804, CVE-2026-50343

## Description

Project Zero's James Forshaw (2026-09-21) describes a class of bug he calls a dangling COM object registration: a COM class is registered under the system-wide HKLM classes key, so every user and system service can resolve it, but the InprocServer32 DLL it points to is missing. If the missing path is in a location standard users can write, an unprivileged user can create the file and any privileged process that instantiates the class loads attacker-controlled code. The concrete instance is CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}, a Windows-shipped CrossDevice streaming/virtual-camera class whose server DLL is expected at C:\ProgramData\CrossDevice\CrossDevice.Streaming.Source.dll. C:\ProgramData is writable by standard users, so the directory and DLL can be created.

The same dangling registration was first abused in CVE-2026-50343 ('Dark Elevator', Calif, reported 2026-05-20, fixed 2026-07-14). That chain combined two logic flaws: the InstallService (LocalSystem) reads a plugin map (StaticPluginMap under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\InstallService\State) that standard users could write, letting them point the service at an arbitrary CLSID, and the CrossDevice CLSID's server DLL could be planted under %PROGRAMDATA%. Microsoft's fix addressed the InstallService vector, but the dangling registration itself remained, so other privileged COM activators could still be steered to it. CVE-2026-66804 (published 2026-08-11, Windows Cross Device Service, CWE-284, CVSS 7.8) is the fix for the dangling registration and is described by Project Zero as an incomplete fix for CVE-2026-50343. The post notes the issue was reported by the author and 14 others, and the tracker entry is Project Zero issue 538151139. The post also references the Shell Create Object Handler COM service (class 135fd325-45b7-4c30-89f8-4386961669f0), the scheduled task \Microsoft\Windows\Shell\CreateObjectTask and the named event Global\ShellCreateObjectTaskReadyEvent, and a custom COM marshaling technique used to get a SYSTEM-hosted COM service to load the planted DLL; a working exploit is attached to the Project Zero tracker.

Separately, an independent public PoC repository (Rat5ak/CVE-2026-66804-CrossDevice-Service-EoP, credited by SecurityOnline to Daniel Wade of nadsec) claims a different trigger: the Windows Camera Frame Server (LOCAL SERVICE) loads the planted DLL when the virtual camera is started, and the service token's SeImpersonatePrivilege is then abused with GodPotato-derived code to reach SYSTEM. Per the README, the report was submitted to MSRC on 2026-06-01 and closed as a duplicate on 2026-07-27. These claims come from the repository and a secondary news source and were not independently verified. Preconditions per secondary reporting: the HKLM CrossDevice COM registration exists and C:\ProgramData\CrossDevice is absent; systems where the DLL already exists with protected permissions are not exploitable by this path. CISA's SSVC entry records exploitation as none, not automatable, technical impact total. Defender guidance: patch, audit HKLM COM registrations for InprocServer32 targets that do not resolve, review standard-user write access under C:\ProgramData, monitor DLL loads from user-writable paths into SYSTEM or service processes, and enforce strong COM unmarshaling policy (COMGLB_UNMARSHALING_POLICY_STRONG) or EOAC_NO_CUSTOM_MARSHAL where custom marshaling is not required.

## MITRE ATT&CK

- T1574 Hijack Execution Flow
- T1546.015 Event Triggered Execution: Component Object Model Hijacking
- T1559.001 Inter-Process Communication: Component Object Model
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1134.001 Access Token Manipulation: Token Impersonation/Theft
- T1112 Modify Registry

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CrossDevice.Streaming.Source.dll Loaded From ProgramData Into a Privileged Process — Post-Exploitation** (`TL-2026-5581-SPL-002`)

Detects any process loading CrossDevice.Streaming.Source.dll or any DLL from C:\ProgramData\CrossDevice\. In the exploit chain a privileged COM activator (InstallService running as LocalSystem, the Shell Create Object Handler, or Windows Camera Frame Server running as LOCAL SERVICE) instantiates CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496} and loads the attacker DLL, yielding code execution as SYSTEM or LOCAL SERVICE.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1574.001, T1559.001, T1068
- **Data sources:** sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode 7, DeviceImageLoadEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7 (ImageLoaded="*\\CrossDevice.Streaming.Source.dll" OR ImageLoaded="C:\\ProgramData\\CrossDevice\\*")
| stats count min(_time) as first_seen max(_time) as last_seen values(ImageLoaded) as loaded_dll values(Hashes) as hashes values(Signed) as signed values(Signature) as signer by host, Image, User
| convert ctime(first_seen) ctime(last_seen)
| eval detection="TL-2026-5581 CrossDevice COM server DLL loaded from ProgramData (T1574.001, T1559.001)"
```

### Microsoft KQL

```kql
DeviceImageLoadEvents
| where Timestamp > ago(24h)
| where FileName =~ "CrossDevice.Streaming.Source.dll" or FolderPath startswith @"C:\ProgramData\CrossDevice\"
| summarize LoadCount = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), SHA256s = make_set(SHA256) by DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
```

### Sigma

```yaml
title: CrossDevice COM Server DLL Loaded From ProgramData (CVE-2026-66804)
id: 7b2d94e1-5c3a-4f68-a1d0-2e8c6f35b002
status: experimental
description: Detects a process loading CrossDevice.Streaming.Source.dll or any DLL from C:\ProgramData\CrossDevice, indicating a privileged COM activator resolved the dangling CrossDevice CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496} to an attacker-controlled DLL.
references:
  - https://projectzero.google/2026/09/windows-dangling-com.html
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66804
  - https://blog.calif.io/p/dark-elevator-windows-install-service
author: Threadlinqs Team
date: 2026-11-09
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.t1574.001
  - attack.t1559.001
  - attack.t1068
  - cve.2026-66804
  - cve.2026-50343
logsource:
  category: image_load
  product: windows
detection:
  selection_name:
    ImageLoaded|endswith: '\CrossDevice.Streaming.Source.dll'
  selection_path:
    ImageLoaded|startswith: 'C:\ProgramData\CrossDevice\'
  condition: 1 of selection_*
falsepositives:
  - Legitimate Cross Device components on a build where the DLL is properly installed and signed by Microsoft
level: high

```

**Known false positives:**

- Legitimate Cross Device components loading a properly installed, Microsoft-signed DLL from this path on future builds
- Security testing of the public PoC on lab hosts

**Tuning notes:** Enable Sysmon ImageLoad (EID 7) for this path; common community configs exclude most DLL loads. Where a legitimate signed build is observed, allow-list on Signed=true and a Microsoft signer. Pivot on host, Image and User to identify the exploited service (InstallService, Camera Frame Server, Shell Create Object Handler).

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- COM Registration Tamper: CrossDevice CLSID or InprocServer32 Pointing Into User-Writable Paths — Exploitation (locked: unlock with TL Creds)
- Windows Camera Frame Server Spawning Shells or LOLBins — Post-Exploitation Token Abuse (locked: unlock with TL Creds)
- InstallService [indicator] Modified by Non-SYSTEM Account (Dark Elevator / CVE-2026-50343 Vector) (locked: unlock with TL Creds)
- Unsigned DLL From ProgramData Loaded by SYSTEM or Service Account Process (locked: unlock with TL Creds)
- GodPotato or Service-Token Impersonation Leading to SYSTEM Shell — Post-Exploitation (locked: unlock with TL Creds)
- Command Line References to CrossDevice Dangling COM CLSID, InstallService Plugin Map or OleViewDotNet (locked: unlock with TL Creds)
- CrossDevice Dangling COM Server DLL Planted Under ProgramData (CVE-2026-66804) — Exploitation (locked: unlock with TL Creds)
- Shell CreateObjectTask Started by Non-SYSTEM Account (Project Zero COM Marshaling Chain) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 13)

Defanged, TLP:CLEAR.

- URL: `hxxps://github[.]com/Rat5ak/CVE-2026-66804-CrossDevice-Service-EoP`
- URL: `hxxps://github[.]com/califio/publications`

Full set of 13 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Windows Exploitation Techniques: Dangling COM Object Registrations (James Forshaw, Google Project Zero)](https://projectzero.google/2026/09/windows-dangling-com.html)
- [CVE-2026-66804 CVE record (Microsoft Windows Cross Device Service Elevation of Privilege)](https://cveawg.mitre.org/api/cve/CVE-2026-66804)
- [Microsoft Security Update Guide: CVE-2026-66804](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66804)
- [Dark Elevator: Windows Install Service Local Privilege Escalation (CVE-2026-50343)](https://blog.calif.io/p/dark-elevator-windows-install-service)
- [CVE-2026-66804 System Privileges (SecurityOnline)](https://securityonline.info/cve-2026-66804-system-privileges/)
- [CVE-2026-66804 CrossDevice Service EoP PoC repository](https://github.com/Rat5ak/CVE-2026-66804-CrossDevice-Service-EoP)
- [NVD: CVE-2026-50343 Microsoft Install Service EoP](https://nvd.nist.gov/vuln/detail/cve-2026-50343)
- [Calif publications repository (CVE-2026-50343 PoC materials)](https://github.com/califio/publications)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5581