Loading vulnerability…
Dark Elevator is a local elevation-of-privilege vulnerability in Microsoft Install Service, the SYSTEM service supporting the Windows application-installation pipeline. Insufficient privilege management allows a standard authenticated user to influence the service's plugin-to-COM-class mapping and cause the service to activate an attacker-controlled in-process COM server. The exploit chain abuses user-writable plugin configuration together with a Windows COM registration whose server location can be populated by a non-administrative user. Install Service activates the selected plugin in-process, loading the attacker-controlled DLL into its SYSTEM-hosted service process.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains a working local privilege escalation exploit for CVE-2026-50343 against Microsoft Windows InstallService / Microsoft Store update infrastructure. The vulnerability is an incorrect registry ACL / privileged DLL loading issue: a standard interactive user can create or modify plugin state under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\InstallService\State\PlugInList and StaticPluginMap, then trigger InstallService via the WinRT AppInstallManager.SearchForAllUpdatesAsync() API so the SYSTEM service loads an attacker-controlled DLL. Structure: the root contains README.md documenting the bug and usage, exploit.ps1 as the original self-contained PoC, and canary.c as the minimal DLL payload source. The interactive-system-shell-repro/ subdirectory contains a stronger reproduction: Run-InstallServiceInteractiveShell.ps1 sets up a per-run public directory, copies a DLL, writes registry values with reg.exe, triggers the WinRT API, polls for evidence, and cleans up its registry values; Cleanup-InstallServiceInteractiveShell.ps1 removes stale proof values; installservice_interactive_shell_canary.c is a more advanced DLL payload that logs execution details and attempts to spawn an interactive SYSTEM cmd.exe in the active user session. Capabilities: the minimal PoC verifies exploitability and SYSTEM code execution by writing C:\Windows\isp_system_proof.txt and C:\Users\Public\ISP_LOADED.txt from inside the DLL when loaded by svchost/InstallService. The stronger repro goes beyond detection: it attempts token manipulation and process creation to open a visible SYSTEM shell, logs shell PIDs and process metadata, and stores evidence under C:\Users\Public\InstallServiceEopProof and C:\Users\Public\InstallServiceEopEvidence. This is clearly exploit code, not just a detector, and is operational because it includes both trigger logic and payload behavior.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
34 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The earlier Windows privilege-escalation flaw, dubbed Dark Elevator, abused weak registry-key permissions to register a COM class as an installer plug-in and induce InstallService to load it. Its InstallService abuse path was fixed, but the dangling CrossDevice COM registration remained exploitable through a different custom-marshaling technique.
A Windows 11 local privilege escalation vulnerability in InstallService that lets a normal user coerce the SYSTEM service into loading an attacker-controlled DLL via a writable plugin map and a user-plantable COM server path, resulting in deterministic SYSTEM code execution.
A Windows 11 local privilege escalation vulnerability in InstallService that allows an unprivileged user to coerce a SYSTEM service into loading an attacker-controlled DLL via a writable plugin map and a user-plantable COM server path, resulting in deterministic SYSTEM code execution.
A Microsoft-patched vulnerability mentioned only in the Sophos protections table without further detail.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.