Loading story…
Google Project Zero disclosed CVE-2026-66804, a Windows local privilege-escalation flaw caused by a dangling system-wide COM registration for the CrossDevice class. The registration referenced a missing DLL in a user-writable ProgramData location, allowing a local attacker to place a malicious DLL where it could be loaded by a privileged process.
Exploitation uses custom COM marshaling to make a SYSTEM-level Shell Create Object Handler COM server unmarshal the dangling CLSID and load the attacker-controlled DLL, potentially granting SYSTEM-level execution. The vulnerability was an incomplete remediation of CVE-2026-50343 (Dark Elevator); Microsoft has issued a fix, and Project Zero reported that a working exploit was supplied with the original report.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Google Project Zero detailed how custom COM marshaling could make a SYSTEM-level Shell Create Object Handler server load an attacker-controlled DLL through the dangling CrossDevice CLSID. The author stated that a fully working exploit was attached to the original vulnerability report.
Microsoft fixed CVE-2026-66804, a Windows local privilege-escalation vulnerability involving a dangling system-wide CrossDevice COM registration. A local user could plant a DLL in a user-writable ProgramData path and have it loaded by a privileged process.
Microsoft fixed the InstallService abuse path used by CVE-2026-50343, the vulnerability known as Dark Elevator. The remediation did not eliminate a dangling CrossDevice COM registration that could be abused through a different technique.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft fixed **CVE-2026-50343**, a Windows 11 local privilege escalation flaw dubbed **Dark Elevator** that lets a standard user obtain an interactive `NT AUTHORITY\SYSTEM` shell by coercing **InstallService** into loading an attacker-controlled DLL inside a SYSTEM `svchost.exe` process. The issue affects the Windows app installation pipeline and was demonstrated on Windows 11 build `10.0.26200.8457`, including Windows 11 25H2, with researchers describing exploitation as deterministic and requiring no administrator rights, UAC approval, reboot, or service-control permissions. The exploit chains two logic flaws: a user-writable `StaticPluginMap` registry location that InstallService uses to select COM plugins, and a Windows-shipped **CrossDevice** COM class whose `InprocServer32` DLL path points to a writable location under `%PROGRAMDATA%`. By abusing COM object loading behavior associated with functions such as `CoCreateInstance`, an attacker can force privileged code to load a malicious library and execute within a Microsoft-signed SYSTEM service process, enabling persistence, privileged account creation, service installation, tampering with machine-wide settings, access to other users' data, and interference with local security controls.
Jul 24, 2026
A public proof-of-concept exploit dubbed **MiniPlasma** has been released for a Windows local privilege escalation flaw that can grant attackers **SYSTEM** access on fully patched machines. The exploit targets `cldflt.sys`, the Windows Cloud Files Mini Filter Driver used by cloud sync features such as OneDrive, and specifically abuses the `HsmOsBlockPlaceholderAccess` routine. Researchers said the bug appears tied to **`CVE-2020-17103`**, a vulnerability originally reported by Google Project Zero's James Forshaw in 2020 and believed to have been fixed by Microsoft, but the original exploit path reportedly still works. The exploit abuses missing access checks and a race condition during token switching to create arbitrary registry keys in the `.DEFAULT` user hive and ultimately spawn a SYSTEM shell. Researcher Chaotic Eclipse, also referenced as Nightmare-Eclipse, published the code on GitHub, while Will Dormann reported that it works reliably on Windows 11 systems with the May 2026 updates, though not on the latest Insider Preview Canary builds. Because the affected driver is broadly deployed across Windows environments, the release of reliable public exploit code sharply raises near-term risk while organizations await clarification or a fix from Microsoft.
Jul 1, 2026
Researchers detailed a series of local privilege-escalation attacks against antivirus and EDR products that abused **COM hijacking** to load attacker-controlled DLLs into trusted front-end processes and then pivot into privileged back-end services. The work showed a recurring design weakness: low-privileged user-facing components were allowed to issue powerful requests to `SYSTEM` services over named pipes or RPC without sufficient validation. In one generalized attack pattern, modified backend messages were used to write attacker-controlled registry values and alter application paths so that a privileged security process later launched code from a user-writable location, yielding `SYSTEM` access. Product-specific cases expanded that pattern across multiple vendors. **AVG Internet Security** (`CVE-2024-6510`) was exploited by combining COM hijacking, RPC abuse, self-defense disabling, and a TOCTOU race to swap in a malicious DLL for execution as `SYSTEM`; **Webroot Endpoint Protect** (`CVE-2023-7241`) exposed a file-deletion primitive over `\\.\pipe\WRSVCPipe` that was chained into DLL hijacking for a `SYSTEM` shell; **Check Point Harmony** (`CVE-2024-24912`) allowed a privileged service to download a DLL to an attacker-chosen path for lock-screen DLL hijacking; and **Bitdefender Total Security** (`CVE-2023-6154`) let a privileged backend write arbitrary registry values, enabling service `ImagePath` hijacking. The findings echo earlier research on brittle hardening controls in products such as **VirtualBox**, where COM registration abuse and DLL-loading edge cases also undermined process protections.
Jul 24, 2026