A dangling COM registration became a Windows privilege escalation
Serguey Asael Shinder1 min readProject Zero's James Forshaw published a walkthrough on 21 September 2026 of CVE-2026-66804, a Windows privilege escalation he and 14 others reported. It is an incomplete fix for an earlier bug (CVE-2026-50343, "Dark Elevator").
The root cause is a dangling COM registration. The CrossDevice COM object, CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}, was registered system-wide — reachable by all users, including system services — but its server DLL was missing. It pointed at %PROGRAMDATA%\CrossDevice\CrossDevice.Streaming.Source.dll, a path that did not exist inside C:\ProgramData, a location where any user may create directories. Create a DLL there and the object can be instantiated.
Getting it loaded into a privileged process uses custom COM marshaling: an object that implements IMarshal can specify an arbitrary CLSID for unmarshaling, and the COM runtime loads the matching in-process DLL automatically, before the target method runs. Sending a Custom OBJREF naming the dangling CLSID to a privileged COM service loads the attacker DLL.
What it means
A registration is an attack surface even with nothing behind it. The DLL never existed; the pointer did. A CLSID that resolves to a writable path is a latent local-privilege bug whether or not anyone shipped the server.
"Incomplete fix" is the recurring shape. The first fix closed the InstallService path; the registration itself stayed dangling, so a different loader — COM marshaling — reached the same object. Fixing the symptom left the cause.
The check is auditable. Every CLSID that points at a path under a world-writable directory is worth finding before an attacker does; this is a query over the registry, not a mystery.