Windows Exploitation Techniques: Dangling COM Object Registrations
The recent CVE-2026-66804 vulnerability in Windows was an incomplete fix for CVE-2026-50343, known as "Dark Elevator." The root cause of the bug was a dangling COM object registration for CrossDevice COM object with the CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}. This object was registered in the system-wide classes key, making it accessible to all users on the system.
However, the server executable was missing, as it was registered to use a non-existent DLL in the C:\ProgramData directory. This location is commonly used for all users on the system, allowing anyone to create directories and potentially load an arbitrary DLL file.
To exploit this dangling COM object registration and load the malicious DLL into a privileged process, custom COM marshaling was used. When a COM object is unmarshaled, it can lead to the loading of an arbitrary DLL, potentially resulting in privilege escalation. To find a privileged service to send the marshaled COM object to, researchers discovered the Shell Create Object Handler object, a COM service running as SYSTEM but not directly instantiable.
The service needs to be started via the \Microsoft\Windows\Shell\CreateObjectTask scheduled task, which can be started by normal users.
By exploiting this vulnerability, attackers could potentially gain privilege escalation on Windows systems. It is crucial to address this issue promptly to prevent potential security breaches.
Written by urgent.news from Lobsters's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
