# CVE-2026-66804: Windows Dangling COM Object Privilege Escalation

> Microsoft fixed CVE-2026-66804, a privilege escalation bug in Windows, due to a dangling COM object registration.

- Published: 2026-10-01T03:19:15.000Z
- Severity: high
- Category: Vulnerabilities
- Tags: Windows, Privilege Escalation, Microsoft, CVE-2026-66804, CVE-2026-50343
- CVEs: CVE-2026-66804, CVE-2026-50343
- Author: Runtime Rebel Intel
- Primary source: https://projectzero.google/2026/09/windows-dangling-com.html
- Canonical: https://runtimerebel.com/blog/cve-2026-66804-windows-dangling-com-object-privilege-escalation

## Key points

- Attackers can achieve privilege escalation on Windows systems via an unpatched or incompletely fixed COM object vulnerability.
- Affected systems include Microsoft Windows installations vulnerable to CVE-2026-66804 and its predecessor, CVE-2026-50343.
- Defenders must apply the latest Microsoft security updates to address the underlying COM object registration flaw.

## Overview: Unpatched Windows COM Object Leads to [Privilege Escalation](/glossary#privilege-escalation)

Microsoft recently addressed a significant privilege escalation [vulnerability](/glossary#vulnerability) in Windows, identified as [CVE-2026-66804](https://nvd.nist.gov/vuln/detail/CVE-2026-66804). This flaw stems from an incomplete fix for a prior vulnerability, [CVE-2026-50343](https://nvd.nist.gov/vuln/detail/CVE-2026-50343), famously dubbed “Dark Elevator” by Calif. The core issue revolves around a "dangling COM object registration" for the CrossDevice COM object, specifically identified by the CLSID `{E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}`. This vulnerability allows an attacker to load an arbitrary malicious DLL into a privileged process, ultimately leading to elevated privileges on a compromised system. Security professionals should prioritize understanding the underlying mechanics and implementing the necessary mitigations to protect Windows environments, as detailed by [Project Zero](https://projectzero.google/2026/09/windows-dangling-com.html).

## Technical Analysis: Exploiting Windows Dangling COM Object Registrations

COM (Component Object Model) objects require both a server executable (often a DLL for in-process components) and a CLSID entry in the `HKEY_CLASSES_ROOT` registry key that points to this executable. The vulnerability resides in the CrossDevice COM object, which had a system-wide registration but a missing server executable. Specifically, it was registered to use `%PROGRAMDATA%\CrossDevice\CrossDevice.Streaming.Source.dll`. The critical aspect here is that not only does this DLL path not exist by default, but it's also located within the `C:\ProgramData` directory. `C:\ProgramData` is a common, user-writable location, enabling any user to create directories and place files within it.

This misconfiguration allows a low-privileged attacker to create a malicious DLL at the specified `%PROGRAMDATA%` path. When the dangling COM object is instantiated, it will attempt to load this attacker-controlled DLL. The primary challenge for an attacker then becomes how to get this COM object, and thus the malicious DLL, loaded into a *privileged* process to achieve privilege escalation.

The original "Dark Elevator" bug ([CVE-2026-50343](https://nvd.nist.gov/vuln/detail/CVE-2026-50343)) leveraged weak registry key permissions to register the class as an installer plugin, forcing the InstallService to load it. With that specific avenue patched, the new exploitation technique focuses on abusing custom COM marshaling.

### Leveraging Custom COM Marshaling for Privilege Escalation

Custom COM marshaling is a technique where an object implements the `IMarshal` interface to control how it's serialized and deserialized across process boundaries. When an object implementing `IMarshal` is passed between processes, it can specify an arbitrary CLSID to be used during unmarshaling. This means an attacker can craft a `Custom OBJREF` that, when sent to a privileged COM service, specifies the CLSID of the dangling CrossDevice object.

Upon unmarshaling, the privileged service will attempt to load the DLL associated with the specified CLSID. Since the attacker has placed a malicious DLL at `%PROGRAMDATA%\CrossDevice\CrossDevice.Streaming.Source.dll`, this malicious code will be loaded into the privileged process, granting the attacker elevated permissions.

Microsoft has implemented mitigations against custom marshaling abuse since Windows 8, primarily through the `EOAC_NO_CUSTOM_MARSHAL` flag in `CoInitializeSecurity` and the `COMGLB_UNMARSHALING_POLICY_STRONG` policy via `IGlobalOptions::Set`. However, for this technique to succeed, an attacker needs to identify a privileged COM server that *does not* enable these custom marshaling mitigations. The source material indicates that such services exist, specifically mentioning the "Shell Create Object Handler" object as a discovered example that runs as SYSTEM and lacks these mitigations.

## Actionable Recommendations and Mitigations

To protect against [CVE-2026-66804](https://nvd.nist.gov/vuln/detail/CVE-2026-66804) and similar *privilege escalation techniques* abusing dangling COM objects, security teams should prioritize the following:

*   **Apply Security Updates**: The most critical step is to apply all available security patches from Microsoft. This vulnerability has been acknowledged and fixed, so ensuring systems are fully updated will directly address the root cause of the dangling COM object registration.
*   **Enforce [Least Privilege](/glossary#least-privilege)**: Implement and strictly adhere to the principle of least privilege across all user accounts and services. This limits the potential impact if a low-privileged account is compromised.
*   **Monitor Writable System Paths**: Continuously monitor user-writable system directories like `C:\ProgramData` for suspicious DLL creations, especially those matching paths of known vulnerable COM objects. Unexpected DLLs in these locations could indicate an attempted or ongoing [exploit](/glossary#exploit).
*   **Review COM Server Configurations**: For developers and system administrators, review COM server applications to ensure they correctly implement custom marshaling mitigations, such as `EOAC_NO_CUSTOM_MARSHAL` or `COMGLB_UNMARSHALING_POLICY_STRONG`, especially for services operating with elevated privileges. This helps in *mitigating custom COM marshaling abuse*.
*   **[Endpoint](/glossary#endpoint) Detection and Response ([EDR](/glossary#edr))**: Utilize EDR solutions to detect anomalous process behavior, such as a privileged process loading an unexpected DLL from a user-writable directory, which could be indicative of an exploit attempt against a dangling COM object.

**Related:** [Microsoft Patches Record 622 Flaws and Two Zero-Days — Patch Now](/blog/microsoft-patches-record-622-flaws-and-two-zero-days-patch-now), [Windows LegacyHive Zero-Day Exploit Grants Admin Access — Patch Status](/blog/windows-legacyhive-zero-day-exploit-grants-admin-access-patch-status)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/cve-2026-66804-windows-dangling-com-object-privilege-escalation