---
schema: 1
kind: vulnerability
title: "CVE-2026-66804 — Windows Cross Device Service: a dangling COM registration reaches SYSTEM privilege escalation, and Google Project Zero publishes a general method to hunt for others"
headline: "Project Zero details a reusable Windows privilege-escalation technique and a hunting method for finding it elsewhere"
summary: >
  Google Project Zero researcher James Forshaw published a working local
  privilege-escalation exploit for CVE-2026-66804 (CVSS 7.8), fixed in Microsoft's
  August 2026 Patch Tuesday and not reported exploited in the wild. The bug is an
  incomplete fix of an earlier flaw (CVE-2026-50343, "Dark Elevator"): a machine-wide
  COM class registration points to a DLL under a world-writable ProgramData path, and
  Forshaw shows how COM's custom-marshaling mechanism lets an unprivileged user force a
  SYSTEM-context COM server to load a planted DLL from that path. He also publishes a
  general PowerShell method for finding other, still-undiscovered dangling COM
  registrations on any Windows estate.
discovered_at: "2026-09-22T04:35:00Z"
updated_at: null
event_date: "2026-09-21"
run_id: 2026-09-22T0410Z-intel
priority: notable
immediate_action: null
tags: [vulnerabilities, priv-esc, patch-available]
regions: [global]
sectors: [public-sector]
entities: []
techniques: [T1546.015, T1068]
affected_products: ["Microsoft Windows"]
cves:
  - id: CVE-2026-66804
    cvss: "7.8"
    epss: "0.05309"
    type: priv-esc
    vector: local
    auth: post-auth
    status: [patch-available]
    affected: "Windows builds without the August 2026 cumulative update"
    fixed: "August 2026 cumulative update (released 2026-08-11)"
  - id: CVE-2026-50343
    cvss: "7.8"
    epss: "0.00298"
    type: priv-esc
    vector: local
    auth: post-auth
    status: [patch-available]
    affected: "Windows builds without the 2026-07-14 cumulative update"
    fixed: "2026-07-14 cumulative update — this fix left the dangling COM registration itself in place, which CVE-2026-66804 later closed"
sources:
  - url: "https://projectzero.google/2026/09/windows-dangling-com.html"
    publisher: "Google Project Zero (James Forshaw)"
    date: "2026-09-21"
    role: primary
  - url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66804"
    publisher: "Microsoft Security Response Center"
    date: "2026-08-11"
    role: corroborating
  - url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50343"
    publisher: "Microsoft Security Response Center"
    date: "2026-07-14"
    role: corroborating
  - url: "https://github.com/califio/publications/blob/main/MADBugs/windows-CVE-2026-50343/blog.md"
    publisher: "Calif"
    date: "2026-07"
    role: corroborating
closed_sources: []
evidence:
  - quote: "This short blog post is about abusing a privilege escalation bug that Microsoft recently fixed in Windows, CVE-2026-66804, that I and 14 others reported. This issue is an incomplete fix for CVE-2026-50343, a bug dubbed \"Dark Elevator\" by Calif."
    publisher: "Google Project Zero (James Forshaw)"
  - quote: "This object was registered in the system wide classes key, meaning it was accessible to all users on the system, including system services. However the server executable was missing."
    publisher: "Google Project Zero (James Forshaw)"
  - quote: "Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally."
    publisher: "Microsoft Security Response Center"
verification: multi-source
sourcing_note: null
confidence: high
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: B
  credibility: 1
watchlist_hit: false
actions: []
updates: []
migrated_from: null
---

Google Project Zero researcher James Forshaw published a working local-privilege-escalation exploit on 2026-09-21 for CVE-2026-66804, "Windows Cross Device Service Elevation of Privilege Vulnerability" (CVSS 7.8, fixed in Microsoft's August 2026 Patch Tuesday on 2026-08-11; Microsoft rates it "Exploitation More Likely" with no observed in-the-wild exploitation) ([Google Project Zero, 2026-09-21](https://projectzero.google/2026/09/windows-dangling-com.html); [Microsoft Security Response Center, 2026-08-11](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66804)). The bug is an incomplete fix of an earlier flaw, CVE-2026-50343 ("Dark Elevator," disclosed by the security research team Calif and fixed 2026-07-14 ([Microsoft Security Response Center, 2026-07-14](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50343); [Calif](https://github.com/califio/publications/blob/main/MADBugs/windows-CVE-2026-50343/blog.md))): a COM object registration for the "CrossDevice" class, CLSID `{E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}`, is registered machine-wide under the classes root but points to a server DLL, `%ProgramData%\CrossDevice\CrossDevice.Streaming.Source.dll`, that does not exist, and `%ProgramData%` is writable by any local, unprivileged user, who can plant an arbitrary malicious DLL at that exact path ("this object was registered in the system wide classes key, meaning it was accessible to all users on the system, including system services. However the server executable was missing" — [Google Project Zero, 2026-09-21](https://projectzero.google/2026/09/windows-dangling-com.html)). Microsoft's July fix closed the original exploitation route — weak registry permissions letting the class be registered as an installer plugin loaded by InstallService — without removing the dangling registration itself, leaving it exploitable by a different route.

Forshaw supplies that route: COM's opt-in custom-marshaling mechanism lets an object specify an arbitrary class id for server-side unmarshaling, so sending a custom object reference naming the dangling class id to a SYSTEM-context COM server that has not enabled the corresponding unmarshaling-policy protections causes the runtime to load the attacker's planted DLL into that privileged process automatically, before any target method is even called ([Google Project Zero, 2026-09-21](https://projectzero.google/2026/09/windows-dangling-com.html)). He identifies the "Shell Create Object Handler" COM service, hosted in a SYSTEM-context process, as one exploitable target: it is not directly instantiable through the normal COM activation API but is started by any authenticated local user via a scheduled task under the Windows Shell task path, and its sole custom interface accepts a parameter the attacker fills with the fake-marshaled dangling-class object, yielding SYSTEM code execution ([Google Project Zero, 2026-09-21](https://projectzero.google/2026/09/windows-dangling-com.html)). Forshaw also publishes a general PowerShell method, built on his own OleViewDotNet and NtObjectManager tooling, that enumerates every in-process COM class registered in the machine hive whose server DLL path cannot actually be resolved — a reusable technique for finding other, still-undiscovered dangling COM registrations on any Windows estate, independent of this specific CVE.

**Detection:** a SYSTEM-context COM host loading a DLL from a user-writable path such as `%ProgramData%\<vendor>\` is the sharpest single signal in image-load or process-creation telemetry; correlate it with a preceding scheduled-task-start event for a task startable by a non-admin account, followed within seconds by an out-of-process COM activation into that same host. **Triage:** legitimate installers and update agents also write to ProgramData and start scheduled tasks; the discriminator is the specific sequence — a non-admin-startable scheduled task immediately followed by out-of-process COM activation into an already-running, unrelated SYSTEM service, plus a SYSTEM process loading a DLL with no corresponding installed application — which routine software activity does not produce.

**Defender takeaway:** apply the August 2026 cumulative update if not already installed; as a reusable defense-in-depth measure, run Forshaw's published enumeration method against the machine hive to find other COM classes whose registered DLL cannot be resolved, and either remove the dangling registration or lock down write access to the target path; on privileged COM servers an organization runs itself, enable the corresponding strong-unmarshaling-policy protections to block custom-marshal abuse generally.