A newly uncovered vulnerability in Windows, identified as CVE-2026-66804, has raised significant security concerns. This flaw allows a low-privileged user to exploit the system by inserting a malicious DLL, subsequently gaining full NT AUTHORITYSYSTEM privileges. The exploit leverages a persistent weakness in Windows’ handling of Component Object Model (COM) registrations.
Patch Released Amid Security Concerns
Microsoft addressed this issue in its August Patch Tuesday update after it was reported by a researcher from Google’s Project Zero. This patch was part of a broader effort to fix 14 vulnerabilities, though it emerged as an incomplete resolution to a prior vulnerability known as “Dark Elevator.” The core issue originates from a dangling COM object registration associated with the Windows CrossDevice component, utilized for functions such as Phone Link and clipboard synchronization.
Technical Details of the Exploit
The vulnerability stems from a specific COM object registered under the CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}, which was accessible to all users on the system. The DLL it referenced, located at %PROGRAMDATA%CrossDeviceCrossDevice.Streaming.Source.dll, did not exist on affected systems. This absence provided an opportunity for attackers to place an arbitrary DLL at this location, allowing the COM object to execute attacker-controlled code.
The previous flaw, CVE-2026-50343, exploited weak registry key permissions to manipulate the class as an installer plugin, urging the SYSTEM-level InstallService to load it into memory. Although the InstallService vulnerability was patched in July 2026, the lingering dangling COM reference prompted researchers to seek alternative activation methods.
Implications and Recommendations
Google Project Zero identified a workaround by exploiting custom COM marshaling. This technique allows a COM interface method implemented out-of-process to marshal its parameters into a remote procedure call, using an OBJREF structure. By directing the CLSID to the vulnerable CrossDevice class, attackers could force privileged processes to load the malicious DLL.
Despite Microsoft’s anticipation of such exploits, there remains a need for a privileged SYSTEM COM server that neglects to implement hardening controls to prevent this abuse. Researchers found such a target within the Shell Create Object Handler, which operates under a SYSTEM dllhost process that permits custom marshaling.
Rated as a high-severity vulnerability with a CVSS score of 7.8, CVE-2026-66804 poses a tangible risk. Administrators are strongly advised to implement the August 2026 updates to eliminate the dangling registration that facilitates this exploit. Beyond applying patches, this situation highlights the overlooked threat posed by dangling COM registrations, urging defenders to proactively search for unresolved in-process COM classes where attackers might plant malicious DLLs.
